PT-2023-29794 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: An issue in the software allows an attacker to execute arbitrary commands via the admin safe.php component. Recommendations: For SeaCMS version 12.9, consider disabling access to the admin safe.php component...

PT-2023-29572 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzzCMS version 2.1.9 Description: The issue allows a remote attacker to execute arbitrary code via a crafted file to the down url function in the zzz.php file. This enables the attacker to potentially gain control over the system...

PT-2023-29968 · Unknown · Ndk Steppingpack

Name of the Vulnerable Software and Affected Versions: ndk steppingpack versions 1.5.6 and before Description: The issue allows a guest to perform SQL injection. The method NdkSpack::getPacks has sensitive SQL calls that can be executed with a trivial HTTP call and exploited to forge a SQL...

PT-2023-29291 · Ritecms · Ritecms

Name of the Vulnerable Software and Affected Versions: RiteCMS version 3.0 Description: A File upload issue allows a local attacker to upload a SVG file containing XSS content. Recommendations: For RiteCMS version 3.0, consider restricting file uploads to prevent exploitation until a fix is...

Medium: composer

Issue Overview: Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions...

PT-2023-6595 · Tp Link · Tp-Link Tl-Wr886N

Name of the Vulnerable Software and Affected Versions: TP-LINK TL-WR886N version 7.0 3.0.14 Build 221115 Rel.56908n.bin Description: The issue is related to a stack overflow in the getRegVeriRegister function of the TP-LINK TL-WR886N router's firmware, which can be exploited by a remote attacker ...

PT-2023-8372 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance version 10.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2023-26053 · Unknown · Uvdesk Community Skeleton

Name of the Vulnerable Software and Affected Versions: UVDesk Community Skeleton version 1.1.1 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket. This enables...

PT-2023-6593 · Tp Link · Tp-Link Tl-Wr886N

Name of the Vulnerable Software and Affected Versions: TP-LINK TL-WR886N version 7.0 3.0.14 Build 221115 Rel.56908n.bin Description: The issue is related to a stack overflow in the registerRequestHandle function, which can be exploited by a remote attacker to impact the integrity, availability, a...

PT-2023-29814 · Unknown · Thingnario Photon

Name of the Vulnerable Software and Affected Versions: ThingNario Photon version 1.0 Description: An issue in the software allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the ping function at the "thingnario Logger Maintenance Webpage" endpoint...

PT-2023-29787 · Unknown · I-Doit Pro

Name of the Vulnerable Software and Affected Versions: i-doit pro versions 25 and below Description: The issue is related to Cross Site Scripting XSS and can be exploited via the index.php endpoint. This allows for potential malicious script injection. Recommendations: For versions 25 and below,...

The vulnerability of the Bluetooth module of the EMUI operating system of HarmonyOS allows a hacker to disable the Bluetooth function.

The vulnerability of the Bluetooth module of the EMUI operating system of HarmonyOS is related to the disclosure of information in an erroneous data field. Exploiting this vulnerability could allow a remote attacker to cause the Bluetooth function to become unavailable...

Everyone can disable policy of any brahama console account

Lines of code Vulnerability details Impact Everyone can disable policy of any brahama console account if you look at the function disablePolicyOnConsole it designed to disable the policy and set guards to 0 which is important decision of any account but the problem is everyone can disable random...

PT-2023-32056 · WordPress · Form For All

Name of the Vulnerable Software and Affected Versions: Contact form Form For All plugin for WordPress versions up to, and including, 1.2 Description: The issue is related to Stored Cross-Site Scripting via the 'formforall' shortcode due to insufficient input sanitization and output escaping on...

PYSEC-2023-229

ArchiveBox is an open source self-hosted web archiving system. Any users who are using the wget extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to...

PT-2023-29711 · Unknown · Artifact Hub

Name of the Vulnerable Software and Affected Versions: Artifact Hub versions prior to 1.16.0 Description: Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. It includes a fine-grained authorization mechanism that...

PT-2023-29538 · Prestashop · Creative Popup

Name of the Vulnerable Software and Affected Versions: Creative Popup versions up to 1.6.9 Description: A SQL injection issue exists in the Creative Popup module for PrestaShop, allowing a guest to perform SQL injection via the cp download popup function. Recommendations: For versions up to 1.6.9...

PT-2023-29709 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions prior to 10.6.2 Description: Directus is a real-time API and App dashboard for managing SQL database content. In affected versions, any Directus installation that has websockets enabled can be crashed if the websocket server...

PT-2023-6360 · Connectize · Connectize Ac21000 G6

Name of the Vulnerable Software and Affected Versions: Connectize AC21000 G6 version 641.139.1.1256 Description: An issue in the change password functionality of the Connectize AC21000 G6 allows attackers to gain control of the device without prompting for the current password. This is related to...

PT-2023-29705

Name of the Vulnerable Software and Affected Versions ArchiveBox affected versions not specified Description The issue affects users of the wget extractor who view the content it outputs. If a user is logged in to the ArchiveBox admin site in the same browser session and views an archived malicio...