PT-2023-13421 · Vermeg · Vermeg Agilereporter

Name of the Vulnerable Software and Affected Versions: VERMEG AgileReporter version 21.3 Description: An issue was discovered in VERMEG AgileReporter where XXE can occur via an XML document to the Analysis component. Recommendations: For VERMEG AgileReporter version 21.3, consider restricting...

PT-2023-23985 · Alkaweb · Alkaweb Eonet Manual User Approve Plugin

Name of the Vulnerable Software and Affected Versions: Alkaweb Eonet Manual User Approve plugin versions = 2.1.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Alkaweb Eonet Manual User Approve plugin. This vulnerability requires authenticati...

PT-2023-29150 · Sonicwall · Sonicwall Directory Services Connector

Name of the Vulnerable Software and Affected Versions: SonicWall Directory Services Connector Windows MSI client versions 4.1.21 and earlier Description: A local privilege escalation issue allows a local low-privileged user to gain system privileges through running the recovery feature...

CVE-2023-5783

A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/system/approvecenter/flowsort/flow/delete.php. The manipulation of the argument id/sortparent leads to sql injection. The attack c...

PT-2023-7352 · Ashlar Vellum · Ashlar-Vellum Graphite

Name of the Vulnerable Software and Affected Versions: Ashlar-Vellum Graphite version 13.0.48 Description: The issue is related to a lack of proper validation of user-supplied data when parsing VC6 files, which could lead to an out-of-bounds read. This may allow an attacker to execute arbitrary...

PT-2023-29832 · Lavacode · Lavacode Lava Directory Manager

Name of the Vulnerable Software and Affected Versions: Lavacode Lava Directory Manager plugin versions = 1.1.34 Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This allows for the storage of malicious scripts that can be executed by other users,...

PT-2023-29494 · Sielco · Analog Fm Transmitter +12

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain...

PT-2023-26363 · Unknown · Egroupware

Name of the Vulnerable Software and Affected Versions: eGroupWare version 17.1.20190111 Description: An issue affects the setup panel under setup/manageheader.php, allowing authenticated remote attackers with administrator credentials to read a cleartext database password due to improper password...

PT-2023-29827 · Wpdevart · Wpdevart Contact Form Builder +1

Name of the Vulnerable Software and Affected Versions: wpdevart Contact Form Builder, Contact Widget plugin versions 2.1.6 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website,...

PT-2023-26180 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 9.4-rc-1 through 14.10.7 XWiki Platform versions 15.3-rc-1 and earlier Description: The issue arises when a document has been deleted and re-created, allowing users with view rights on the re-created document but not o...

PT-2023-30144 · Cloudbees +1 · Jenkins Cloudbees Cd Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins CloudBees CD Plugin versions 1.1.32 and earlier Description: The issue allows attackers who can configure jobs to publish arbitrary files from the Jenkins controller file system to the previously configured CloudBees CD server. This i...

PT-2023-6486

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 13.1.5 through 17.1.0 Description An authentication bypass exists in the configuration utility of F5 BIG-IP, including Access Policy Manager, Advanced Firewall Manager, Analytics, Application Acceleration Manager, Applicatio...

PT-2023-30011 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.652 B20230116 Description: A command execution issue was found in the sub 4155DC function, allowing for potential exploitation. Recommendations: For TOTOLINK X6000R version 9.4.0cu.652 B20230116, consider...

PT-2023-16923 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue is related to reflected cross-site scripting in the StudentSearch component, allowing attackers to hijack a user's browsing session if the user clicks on a malicious link...

PT-2023-29867

Name of the Vulnerable Software and Affected Versions D-Tale versions prior to 3.7.0 Description The issue allows remote code execution, enabling attackers to run malicious code on the server. This is particularly concerning for users hosting D-Tale publicly. The estimated number of potentially...

PT-2023-20748 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns an unauthenticated SQL injection in the GetVisitors method, allowing unauthenticated attackers to extract or modify all data. Recommendations: For versions 3.1.052...

WordPress Product Recommendation Quiz for eCommerce Plugin <= 2.1.2 is vulnerable to Broken Access Control

Software Product Recommendation Quiz for eCommerce Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.2.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46631 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID aca78f403747 Credits...

PT-2023-8359 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.1 Description: A permissions issue was addressed with additional restrictions. This issue may allow an app to access user-sensitive data. The vulnerability is related to insufficient access restrictions in th...

PT-2023-30076 · Totolink · Totolink X2000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X2000R Gh version 1.0.0-B20230221.0948.web Description: A stack overflow issue was discovered in the function formStats. Recommendations: For version 1.0.0-B20230221.0948.web, as a temporary workaround, consider disabling the formSta...

PT-2023-29897 · Scientech It Solution · Scientech It Solution Appointment Calendar

Name of the Vulnerable Software and Affected Versions: Scientech It Solution Appointment Calendar plugin versions = 2.9.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...