PT-2023-4786 · Atlassian · Confluence +2

Name of the Vulnerable Software and Affected Versions: Okio versions prior to the fixed versions Bitbucket Data Center and Server versions 7.17.0 through 8.14.0 Confluence Data Center and Server versions 7.13.0 through 8.7.0 Description: The issue is related to the GzipSource class in the Okio...

PT-2023-23658 · Apache +1 · Apache Jena +1

Name of the Vulnerable Software and Affected Versions: Apache Jena versions 3.7.0 through 4.8.0 Description: The issue is related to insufficient restrictions of called script functions in Apache Jena, allowing a remote user to execute javascript via a SPARQL query. Recommendations: For Apache Je...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure due to using an external library which, by default, allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure due to using an external library which, by default, allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database...

CVE-2023-34029

Cross-Site Request Forgery CSRF vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin = 2.3.3 versions...

CVE-2023-34029

Cross-Site Request Forgery CSRF vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin = 2.3.3 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin = 2.3.3 versions...

PT-2023-26097 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC version 2.3-DEV-rev381-g817a848f6-master Description: A segmentation violation was discovered in the gf dump vrml sffield function at /lib/libgpac.so. This issue affects the specified version of GPAC. Recommendations: For GPAC version...

PT-2023-26098 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC version 2.3-DEV-rev381-g817a848f6-master Description: A segmentation violation was discovered in the gf isom remove user data function at /lib/libgpac.so. This issue affects the specified version of GPAC. Recommendations: For GPAC versio...

PT-2023-20832 · Prestashop +1 · Vivawallet +1

Name of the Vulnerable Software and Affected Versions: PrestaShop vivawallet versions 1.7.10 and earlier Description: A SQL injection issue allows a remote attacker to gain privileges via the vivawallet module. This could potentially lead to unauthorized access and control of the system...

PT-2023-26099 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC version 2.3-DEV-rev381-g817a848f6-master Description: A segmentation violation was discovered in the BM ParseIndexValueReplace function at /lib/libgpac.so. This issue affects the GPAC library. Recommendations: For GPAC version...

New Mozilla Feature Blocks Risky Add-Ons on Specific Websites to Safeguard User Security

Mozilla has announced that some add-ons may be blocked from running on certain sites as part of a new feature called Quarantined Domains. "We have introduced a new back-end feature to only allow some extensions monitored by Mozilla to run on specific websites for various reasons, including securi...

New Mozilla Feature Blocks Risky Add-Ons on Specific Websites to Safeguard User Security

Mozilla has announced that some add-ons may be blocked from running on certain sites as part of a new feature called Quarantined Domains. "We have introduced a new back-end feature to only allow some extensions monitored by Mozilla to run on specific websites for various reasons, including securi...

Explanation about 'nshttpd' internal services up on ports 80.

After a recent upgrade from 13.0 build 90.11 to 13.1 build 48.47, I noticed a new internal service was installed. "set service nshttpd-gui-x.x.x.x -80 -cip ENABLED" Is this a necessary service and what is it's purpose? If it's not needed, I'd like to disable since it's using port 80...

PT-2023-5384 · D Link · D-Link Dwl-6610Ap

Name of the Vulnerable Software and Affected Versions: D-LINK DWL-6610 version FW v 4.3.0.8B003C Description: The issue is related to a command injection vulnerability in the sub 2EF50 function. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter...

PT-2023-10353 · Dynacase · Dynacase Webdesk

Name of the Vulnerable Software and Affected Versions: Dynacase Webdesk versions prior to 3.2-20180305 Description: A critical issue was found in Dynacase Webdesk, affecting the freedomrss search function of the freedomrss search.php file. This issue leads to sql injection. Recommendations: Upgra...

PT-2023-25743 · Unknown · Phpgurukul Online Security Guards Hiring System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Security Guards Hiring System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted payload to the "search booking box" API endpoint. This is a Cross-Site Scripting XSS issue, which mean...

PT-2023-33044 · Unknown · Sweetalert2

Name of the Vulnerable Software and Affected Versions: sweetalert2 versions 11.6.14 and above Description: The sweetalert2 package exhibits potentially undesirable behavior by outputting audio and/or video messages unrelated to its functionality when run on specific top-level domains TLDs. This...

PT-2023-25419 · Kodbox · Kodbox

Name of the Vulnerable Software and Affected Versions: kodbox version 1.26 Description: A critical issue affects the function Execute of the file webconsole.php.txt in the WebConsole Plug-In component, leading to os command injection. The exploit has been disclosed publicly and may be used. The...

PT-2023-6404 · Nextcloud +1 · Nextcloud Calendar +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Calendar app versions prior to 4.4.4 Description: The issue is related to missing precondition checks in the Nextcloud calendar app, which causes the server to attempt validation of strings of any length as email addresses. This can...