PT-2023-8682 · Unknown · Scalefusion

Name of the Vulnerable Software and Affected Versions: ScaleFusion versions 10.5.2 through 10.5.6 Description: The issue is related to insufficient access control in the isolated environment of Scalefusion MDM Agent, which can be exploited to impact the confidentiality, integrity, and availabilit...

PT-2023-7313 · Zyxel · Zyxel Nas326 +1

Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 version V5.21AAZF.14C0 Zyxel NAS542 version V5.21ABAG.11C0 Description: A command injection issue exists in the show zysync server contents function, allowing an unauthenticated attacker to execute some operating system commands ...

PT-2023-31283 · Jenkins · Jenkins Neuvector Vulnerability Scanner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier Description: A cross-site request forgery CSRF vulnerability exists due to the lack of permission checks in a connection test HTTP endpoint, allowing attackers with...

PT-2023-36324 · Amazon · Ec2 Hibagent

Name of the Vulnerable Software and Affected Versions: EC2 hibagent versions prior to the update that adds IMDSv2 support Description: The issue concerns the use of an insecure protocol by IMDSv1, which is no longer recommended. The EC2 hibagent package has been updated to add IMDSv2 support...

PT-2023-29562 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version US AC10V4.0si V16.03.10.13 cn Description: A stack overflow issue was discovered via the list parameter in the sub 49E098 function. Recommendations: For Tenda AC10 version US AC10V4.0si V16.03.10.13 cn, consider restricting...

PT-2023-19518

Name of the Vulnerable Software and Affected Versions Zumtobel Netlink CCD Onboard version 3.74 Description A buffer overflow issue was discovered in the NetlinkWeb::Information::SetDeviceIdentification component. This issue affects the specified version of the Zumtobel Netlink CCD Onboard...

PT-2023-7939 · Linux +9 · Linux Kernel +9

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.7 Description: A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. The read size of a perf event can...

PT-2023-32568 · WordPress · Bookingpress

Name of the Vulnerable Software and Affected Versions: BookingPress plugin for WordPress versions up to, and including, 1.0.76 Description: The issue is related to insufficient file validation on the bookingpress process upload function, allowing authenticated attackers with administrator-level...

PT-2023-32443 · WordPress · Post Smtp Mailer

Name of the Vulnerable Software and Affected Versions: POST SMTP Mailer WordPress plugin versions prior to 2.7.1 Description: The issue allows an unauthenticated attacker to perform XSS attacks against highly privileged users by not escaping email message content before displaying it in the...

PT-2023-31035 · Tenda · Tenda Ax1803

Name of the Vulnerable Software and Affected Versions: Tenda AX1803 version 1.0.0.1 Description: The issue allows a remote attacker to execute arbitrary code via the schedStartTime parameter or the schedEndTime parameter in the function setSchedWifi. This enables the attacker to potentially gain...

PT-2023-28384 · WordPress · Eventprime

Name of the Vulnerable Software and Affected Versions: EventPrime WordPress plugin versions prior to 3.3.0 Description: The issue allows an attacker to purchase bookings without making a payment by manipulating the price specified in the client request. Recommendations: For versions prior to 3.3....

PT-2023-30449 · Pachno · Pachno

Name of the Vulnerable Software and Affected Versions: Pachno version 1.0.6 Description: A vulnerability has been identified that allows an authenticated attacker to execute a cross-site scripting XSS attack. The issue exists due to inadequate input validation in the Project Description and...

PT-2023-30718 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop opartdevis versions 4.5.18 through 4.6.12 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via a crafted script to the getModuleTranslation function. This enables the attacker to potentially...

PT-2023-31967 · WordPress · Cleantalk

Name of the Vulnerable Software and Affected Versions: CleanTalk WordPress plugin versions prior to 2.121 Description: The issue allows an attacker to manipulate the client IP address retrieved by the Security & Malware scan, potentially bypassing bruteforce protection. This is due to the plugin...

PT-2023-28966 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to check if the "Allow users to view archived channels" setting is enabled when displaying permalink previews. This oversight allows members to...

PT-2023-7350 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 12.1.2.15356 Description: A use-after-free issue exists in the way Foxit Reader handles 3D annotations. This can be triggered by a specially crafted Javascript code inside a malicious PDF document, leading to memory...

PT-2023-32412 · WordPress · Job Manager & Career

Name of the Vulnerable Software and Affected Versions: Job Manager & Career WordPress plugin versions prior to 1.4.4 Description: The issue allows an unauthorized user to view and download private files of other users due to a vulnerability in the Directory Listings system. This poses a serious...

PT-2023-32291 · WordPress · Wordpress Backup & Migration

Name of the Vulnerable Software and Affected Versions: WordPress Backup & Migration WordPress plugin versions prior to 1.4.4 Description: The issue allows users with a role as low as Subscriber to update some plugin settings due to a lack of authorization for certain AJAX requests. Recommendation...

Code injection

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable...

PT-2023-32526

Name of the Vulnerable Software and Affected Versions Neutron IP Camera versions prior to b1130.1.0.1 Description The issue is related to a Path Traversal vulnerability, allowing Absolute Path Traversal using '/../filedir'. This enables unauthorized access to files on the system. Recommendations...