PT-2023-31494 · Trimble · Trimble Sketchup Viewer

Name of the Vulnerable Software and Affected Versions: Trimble SketchUp Viewer affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability...

PT-2023-32842 · Unknown · Lightxun Iptv Gateway

Name of the Vulnerable Software and Affected Versions: Lightxun IPTV Gateway versions up to 20231208 Description: A vulnerability was found in the processing of the file /ZHGXTV/index.php/admin/index/web upload template.html. The manipulation of the file argument leads to unrestricted upload. The...

PT-2023-32825

Name of the Vulnerable Software and Affected Versions MLflow affected versions not specified Description The issue allows attackers to gain full command execution on the victim system with only one user interaction, which involves downloading a malicious config. This is related to a Command...

PT-2023-8082 · Totolink · Totolink A7100Ru

Name of the Vulnerable Software and Affected Versions: Totolink A7100RU version 7.4cu.2313 B20191024 Description: A critical issue has been found in the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag...

PT-2023-32813 · Jahastech · Nxfilter

Name of the Vulnerable Software and Affected Versions: Jahastech NxFilter version 4.3.2.5 Description: A problematic vulnerability was found in Jahastech NxFilter, affecting the file /config,admin.jsp. The manipulation of the admin name argument leads to cross-site request forgery. The attack can...

PT-2023-32814 · Jahastech · Nxfilter

Name of the Vulnerable Software and Affected Versions: Jahastech NxFilter version 4.3.2.5 Description: A problematic issue has been found in the Bind Request Handler component, affecting the processing of the file user,adap.jsp?actionFlag=test&id=1. This leads to ldap injection and can be initiat...

PT-2023-30804 · Softnext · Softnext Mail Sqr Expert

Name of the Vulnerable Software and Affected Versions: Softnext Mail SQR Expert affected versions not specified Description: The issue is related to a path traversal vulnerability within a specific URL parameter. This allows an unauthenticated remote attacker to bypass authentication and download...

PT-2023-32538 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially...

PT-2023-31456 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /admin/database/backup component. This allows for unauthorized actions to be performed on the system. Recommendations: For Dreamer CMS...

CVE-2023-47624 Audiobookshelf Arbitrary File Read Vulnerability

Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, any user regardless of their permissions may be able to read files from the local file system due to a path traversal in the /hls endpoint. This issue may lead to Information Disclosure. As of time of...

PT-2023-32767 · Unknown · Phpgurukul Teacher Subject Allocation Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Teacher Subject Allocation Management System version 1.0 Description: A problematic vulnerability has been found in the PHPGurukul Teacher Subject Allocation Management System. The issue affects an unknown function of the file...

GHSA-4RGC-5G6R-2RJF lakeFS logs S3 credentials in plain text

Impact S3 credentials are logged in plain text S3Creds:Key:AKIAIOSFODNN7EXAMPLE Secret:wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY appears as part of the log message: time="2023-05-12T13:51:52Z" level=error msg="failed to perform diff" func="pkg/plugins/diff.Service.RunDiff"...

PT-2023-31259 · Voltronic Power · Voltronic Power Snmp Web Pro

Name of the Vulnerable Software and Affected Versions: Voltronic Power SNMP Web Pro version 1.1 Description: The issue allows an attacker to execute arbitrary code via a crafted script within a request to the webserver. This is a Cross Site Scripting XSS issue. Recommendations: For Voltronic Powe...

PT-2023-8591 · Adobe · Substance3D - Stager

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Stager versions 2.1.1 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigatio...

PT-2023-25652 · Grafana +1 · Loki +2

Name of the Vulnerable Software and Affected Versions: ProLion CryptoSpike version 3.0.15P2 Description: The issue allows remote attackers to impersonate other users in web management and the REST API by reading JWT tokens from logs as a Grafana authenticated user or from the Loki REST API withou...

PT-2023-31555 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: The issue allows a remote attacker to read files via ../ Directory Traversal in the "/common/down/file" fileKey parameter. This could potentially lead to unauthorized access to sensitive information...

PT-2023-32715 · Typecho · Typecho

Name of the Vulnerable Software and Affected Versions: Typecho version 1.2.1 Description: A vulnerability has been found in the Logo Handler component of Typecho, affecting an unknown function of the file /admin/options-theme.php. This issue leads to cross site scripting and can be exploited...

PT-2023-7920 · D Link · D-Link Dir-850L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L version B1 FW223WWb01 Description: The issue is related to the firmware of D-Link DIR-850L routers, specifically version B1 FW223WWb01, where a remote attacker can execute arbitrary code via a crafted script to the en paramete...

PT-2023-31212 · Tenda · Tenda W30E

Name of the Vulnerable Software and Affected Versions: Tenda W30E version 16.01.0.124843 Description: A stack overflow issue was discovered via the set wan status function. Recommendations: For Tenda W30E version 16.01.0.124843, as a temporary workaround, consider disabling the set wan status...

PT-2023-7498 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Description: The issue is related to insufficient input validation in Microsoft Edge, allowing a remote attacker to gain unauthorized access to protected information. Recommendations: At the...