PT-2023-22944 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform versions 420, 430 Description: The issue allows an authenticated attacker to access sensitive information that is otherwise restricted. Successful exploitation could have a high impact on...

PT-2023-17145 · WordPress · Ai Chatbot

Name of the Vulnerable Software and Affected Versions: AI ChatBot WordPress plugin versions prior to 4.5.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...

PT-2023-18240 · Unknown · Telephony Framework

Name of the Vulnerable Software and Affected Versions: Telephony framework versions prior to SMR May-2023 Release 1 Description: The issue is related to improper access control in the Telephony framework, allowing local attackers to modify call settings. Recommendations: For versions prior to SMR...

PT-2023-18247 · Unknown · Semsharefileprovider

Name of the Vulnerable Software and Affected Versions: SemShareFileProvider versions prior to SMR May-2023 Release 1 Description: The issue is related to improper access control, allowing local attackers to access protected data. Recommendations: For versions prior to SMR May-2023 Release 1, upda...

PT-2023-14915 · Apache · Apache Streampark

Name of the Vulnerable Software and Affected Versions: Apache StreamPark versions 1.0.0 through 1.0.0 Description: The issue arises when a user successfully logs in and attempts to modify their profile. The username is passed to the server-layer as a parameter but is not verified to ensure it...

CVE-2023-30853 Gradle Build Action data written to GitHub Actions Cache may expose secrets

Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Action prior to version 2.4.2 that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets...

CVE-2023-30852 Pimcore Arbitrary File Read in Admin JS CSS files

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the /admin/misc/script-proxy API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the scriptPath and scripts parameters. The...

CVE-2023-30850 Pimcore SQL Injection Vulnerability in Admin Translations API

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually...

PT-2023-19344 · Unknown · Tinymce Custom Styles Plugin

Name of the Vulnerable Software and Affected Versions: Tim Reeves & David Stöckl TinyMCE Custom Styles plugin versions = 1.1.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the T...

CVE-2023-30544 Kiwi TCMS may allow user to update email address to unverified one

Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the My profile admin page. This page allowed them to change the email address registered with their account without the ownership verification performed...

PT-2023-16601 · WordPress · Steveas Wp Live Chat Shoutbox

Name of the Vulnerable Software and Affected Versions: The Steveas WP Live Chat Shoutbox WordPress plugin versions 1.4.2 and earlier Description: The issue is related to Stored Cross-Site Scripting, which occurs because a parameter is not properly sanitized and escaped before being outputted back...

PT-2023-18380 · Sourcecodester · Sourcecodester Task Reminder System

Name of the Vulnerable Software and Affected Versions: SourceCodester Task Reminder System version 1.0 Description: A vulnerability was found in the processing of the file /classes/Users.php, where the manipulation of the argument id leads to cross-site scripting. The attack may be initiated...

CVE-2023-21096

In OnWakelockReleased of attributionprocessor.cc, there is a use after free that could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-254774758...

CVE-2021-43819 Stargate-Bukkit improperly handles vehicles causing data duplication.

Stargate-Bukkit is a mod for the minecraft video game which adds a portal focused environment. In affected versions Minecarts with chests will drop their items when teleporting through a portal; when they reappear, they will still have their items impacting the integrity of the game world. The...

CVE-2023-21099

In multiple methods of PackageInstallerSession.java, there is a possible way to start foreground services from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2023-21100

In inflate of inflate.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L...

CVE-2023-21087

In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12...

CVE-2023-28440 Denial of service via admin theme import route in Discourse

Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untruste...

PT-2023-22293 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.2 XWiki Platform version 15.0 RC1 and earlier Description: The XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add...

PT-2023-16859 · WordPress · Drag/Drop Multiple File Upload Pro - Contact Form 7 Standard +1

Name of the Vulnerable Software and Affected Versions: Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin versions prior to 2.11.1 Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin versions prior to 5.0.6.4...