PT-2023-32397 · Pkp-Lib · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository pkp/pkp-lib. Recommendations: For versions prior to 3.3.0-16, update to version 3.3.0-16 or lat...

PT-2023-29753 · Idnovate · Idnovate Superuser

Name of the Vulnerable Software and Affected Versions: idnovate superuser versions prior to 2.4.2 Description: The issue allows attackers to bypass authentication via a crafted HTTP call, specifically targeting the SuperUserSetuserModuleFrontController:init component. Recommendations: For version...

PT-2023-27237 · Chef · Chef Automate

Name of the Vulnerable Software and Affected Versions: Chef Automate versions prior to and including 4.10.29 Description: The issue allows remote code execution when uploading a profile through the API or user interface in Chef Automate using the InSpec check command with a maliciously crafted...

PT-2023-32114 · WordPress · Cits Support Svg

Name of the Vulnerable Software and Affected Versions: CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin versions prior to 3.0 Description: The issue concerns the failure to sanitise uploaded SVG files, potentially allowing users with a role as low as Author to upload maliciou...

PT-2023-31965 · WordPress · Memberlite Shortcodes

Name of the Vulnerable Software and Affected Versions: Memberlite Shortcodes WordPress plugin versions prior to 1.3.9 Description: The issue allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admi...

PT-2023-32399 · Pkp · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation, allowing attackers to inject...

PT-2023-28763 · Click Studios · Passwordstate

Name of the Vulnerable Software and Affected Versions: Click Studios SA Pty Ltd Passwordstate versions Build 9785 and before Description: A Cross Site Request Forgery vulnerability allows a local attacker to execute arbitrary code via a crafted request. Recommendations: For versions Build 9785 an...

PT-2023-32401 · Pkp/Ojs · Pkp Ojs

Name of the Vulnerable Software and Affected Versions: pkp/ojs versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository pkp/ojs. Recommendations: For versions prior to 3.3.0-16, update to version 3.3.0-16 or later to...

PT-2023-32402 · Pkp-Lib · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - DOM in the GitHub repository pkp/pkp-lib. This type of attack occurs when an application includes user input in its output without proper...

PT-2023-30305 · Unknown · Virtualmin

Name of the Vulnerable Software and Affected Versions: Virtualmin version 7.7 Description: A Stored Cross-Site Scripting XSS issue in the Server Template under System Setting in Virtualmin allows remote attackers to inject arbitrary web script or HTML via the Template name field while creating...

PT-2023-18085 · Google · Android

Name of the Vulnerable Software and Affected Versions: In Content affected versions not specified Description: The issue allows an attacker to determine whether an app is installed without query permissions, due to side channel information disclosure. This could lead to local information disclosu...

PT-2023-29870 · Unknown · Jumpserver

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.8.0 Description: The issue concerns the default email address for the initial admin user, which is set to [email protected]. This could potentially affect password reset functionality if the domain mycompany.c...

PT-2023-30249 · Crafter · Crater

Name of the Vulnerable Software and Affected Versions: crater versions 6.0.0 through 6.0.6 Description: The issue allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image, specifically through the "/api/v1/company/upload-logo"...

PT-2023-31276 · Opentext · Opentext Asset Management X +1

Name of the Vulnerable Software and Affected Versions: opentext Service Management Automation X SMAX versions 2020.05 through 2022.11 opentext Asset Management X AMX versions 2021.08 through 2022.11 Description: The issue is an open redirect vulnerability that could allow attackers to redirect a...

PT-2023-7245

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.9.0 Description The issue is related to improper validation in the aiohttp HTTP client/server framework, allowing an attacker to modify the HTTP request or create a new one if they control the HTTP method. This can...

PT-2023-9032 · Unknown +8 · Exfatprogs +8

Name of the Vulnerable Software and Affected Versions: exfatprogs versions prior to 1.2.2 Description: The issue is related to the read file dentry set function in the exfatprogs utility, which is associated with out-of-bounds memory access. This could allow an attacker to impact data integrity...

CVE-2023-46604 Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to caus...

PT-2023-29893 · Unknown · Internet Marketing Ninjas Internal Link Building Plugin

Name of the Vulnerable Software and Affected Versions: Internet Marketing Ninjas Internal Link Building plugin versions 1.2.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability...

PT-2023-29881 · Unknown · Userfeedback Team User Feedback

Name of the Vulnerable Software and Affected Versions: UserFeedback Team User Feedback plugin versions 1.0.9 and earlier Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website, which...

PT-2023-29898 · Triberr · Triberr

Name of the Vulnerable Software and Affected Versions: Triberr plugin versions = 4.1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Triberr plugin. This vulnerability requires authentication with admin+ privileges. Recommendations: For...