PT-2023-18367

Name of the Vulnerable Software and Affected Versions Campcodes Retro Basketball Shoes Online Store version 1.0 Description A critical vulnerability was found in the software, affecting the file contactus1.php. The manipulation of the email argument leads to SQL injection. The attack can be...

PT-2023-18381 · Dream Technology · Mica

Name of the Vulnerable Software and Affected Versions: Dream Technology mica versions up to 3.0.5 Description: A problematic issue has been identified, affecting an unknown function of the component Form Object Handler. This issue leads to cross site scripting and can be exploited remotely...

The vulnerability of the MinIO object storage server, related to insecure management of privileges, allows an attacker to disable access to the root account’s credentials.

The vulnerability of the MinIO object storage server relates to a user with administrator privileges in the console. This user can potentially create another user that matches the root access credentials. Once this user is successfully created, the root account’s credentials will no longer functi...

CVE-2023-30611 Reaction metadata exposed in private topics in Discourse-reactions

Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected versions data about what reactions were performed on a post in a private topic could be leaked. This issue has been addressed in version 0.3. Users are advised to...

Node.js: OpenSSL engines can be used to bypass and/or disable the permission model

Arbitrary OpenSSL engines could be loaded in Node.js 20, even when the permission model was enabled, which could bypass and/or disable the permission model, allowing for arbitrary code execution...

Lack of removal of minters reduces chances of survival

Lines of code Vulnerability details Impact It is reasonable to assume there will be occasions of misbehaving minters that will threaten the functioning of the Frankencoin ecosystem and there is no way to disable any such minter without redeploying the contract. Ex. an attacker can deploy a...

PT-2023-18961 · Sick · Sick Fx0-Gpnt00000 Flexisoft Pnet Gatew. +9

Name of the Vulnerable Software and Affected Versions: SICK UE410-EN3 FLEXI ETHERNET GATEW. versions all SICK UE410-EN1 FLEXI ETHERNET GATEW. versions all SICK UE410-EN3S04 FLEXI ETHERNET GATEW. versions all SICK UE410-EN4 FLEXI ETHERNET GATEW. versions all SICK FX0-GENT00000 FLEXISOFT EIP GATEW...

SUSE CVE-2023-30539

Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It is recommended that the Nextcloud Serv...

Design/Logic Flaw

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the cilium-secrets namespace. This could include data such as TLS private keys for Ingress and GatewayAPI resources. An attacker with access to debug...

Wa-Tunnel - Tunneling Internet Traffic Over Whatsapp

This is a Baileys based piece of code that lets you tunnel TCP data through two Whatsapp accounts. This can be usable in different situations, for example network carriers that give unlimited whatsapp data or airplanes where you also get unlimited social network data. It's using Baileys since it'...

PT-2023-12125 · Laravel · Laravel

Name of the Vulnerable Software and Affected Versions: Laravel version 8.5.9 Description: A deserialization vulnerability in the destruct function allows attackers to execute arbitrary commands. Recommendations: For Laravel version 8.5.9, consider disabling the destruct function until a patch is...

PT-2023-22785 · Archery · Archery

Name of the Vulnerable Software and Affected Versions: Archery affected versions not specified Description: The Archery project contains multiple SQL injection vulnerabilities that may allow an attacker to query the connected databases. User input coming from the db name in the sql/data...

PT-2023-22448 · Wbce Cms · Wbce Cms

Name of the Vulnerable Software and Affected Versions: WBCE CMS version 1.5.3 Description: The issue is a command execution vulnerability. It can be exploited via the admin/languages/install.php endpoint. Recommendations: For WBCE CMS version 1.5.3, consider disabling access to the...

PT-2023-2417

Name of the Vulnerable Software and Affected Versions vm2 versions up to 3.9.16 Description The issue exists due to inadequate sanitization of special elements in the handleException function of the vm2 library, allowing a remote attacker to escape the sandbox and execute arbitrary code in the ho...

PT-2023-21369 · Unknown · Prestashopleurlrewrite

Name of the Vulnerable Software and Affected Versions: PrestaShopleurlrewrite versions 1.0 and earlier Description: A SQL injection issue allows a remote attacker to gain privileges via the Dispatcher::getController component. This can be exploited through the Dispatcher::getController function,...

PT-2023-10697 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 11.1.7 and earlier, 11.2.x before 11.2.4, 11.3.x before 11.3.1 Description: The issue is related to Server-Side Request Forgery SSRF via the Kubernetes integration. This can lead to the...

PT-2023-17778 · Sourcecodester · Sourcecodester Vehicle Service Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Vehicle Service Management System version 1.0 Description: A problematic vulnerability has been found in the SourceCodester Vehicle Service Management System. This issue affects an unknown part of the file /classes/Users.php. T...

PT-2023-14288 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev20 Description: The issue allows for cross-site scripting XSS attacks via upsell ads. No information is provided about the estimated number of potentially affected devices worldwide or real-world...

PT-2023-17720 · Sourcecodester · Sourcecodester Vehicle Service Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Vehicle Service Management System version 1.0 Description: A critical issue was found in the system, affecting the /classes/Login.php file. The manipulation of the username argument leads to SQL injection. This issue can be...

PT-2023-17447 · Unknown · Campcodes Advanced Online Voting System

Name of the Vulnerable Software and Affected Versions: Campcodes Advanced Online Voting System version 1.0 Description: A critical vulnerability has been found in the system, affecting an unknown function of the file /admin/positions row.php. The manipulation of the id argument leads to SQL...