PT-2023-29440 · Unknown · Engelsystem

Name of the Vulnerable Software and Affected Versions: Engelsystem versions prior to the version containing commit ee7d30b33 Description: Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against t...

PT-2023-28910 · Apache · Apache Inlong

Name of the Vulnerable Software and Affected Versions: Apache InLong versions 1.4.0 through 1.8.0 Description: The issue is related to Insufficient Verification of Data Authenticity in Apache InLong, allowing a general user to view all user data, including data from Admin accounts. Recommendation...

PT-2023-29439 · Nextcloud · Nextcloud Talk

Name of the Vulnerable Software and Affected Versions: Nextcloud Talk versions prior to 15.0.8 Nextcloud Talk versions prior to 16.0.6 Nextcloud Talk versions prior to 17.1.1 Description: The issue concerns the brute force protection of public talk conversation passwords in Nextcloud Talk, a chat...

PT-2023-32187 · Devolutions · Devolutions Server

Name of the Vulnerable Software and Affected Versions: Devolutions Server versions 2022.3.13.0 and earlier Description: The issue is related to improper access control in permission inheritance, allowing an attacker who has compromised a low-privileged user to access entries through a specific...

PT-2023-28628 · WordPress · Wp Matterport Shortcode

Name of the Vulnerable Software and Affected Versions: WP Matterport Shortcode WordPress plugin versions prior to 2.1.8 Description: The issue is related to the WP Matterport Shortcode WordPress plugin, which does not validate and escape some of its shortcode attributes before outputting them bac...

PT-2023-32201 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: librenms versions prior to 23.10.0 Description: The issue is related to SQL Injection in the GitHub repository librenms/librenms. Recommendations: For versions prior to 23.10.0, update to version 23.10.0 or later to resolve the issue...

PT-2023-24570 · WordPress · Read More & Accordion

Name of the Vulnerable Software and Affected Versions: Read More & Accordion WordPress plugin versions prior to 3.2.7 Description: The issue allows high-privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present, due to the unserialize of user input provide...

PT-2023-29899 · WordPress · Booking Calendar

Name of the Vulnerable Software and Affected Versions: Booking Calendar WordPress plugin versions prior to 9.7.3.1 Description: The issue allows unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators due to the plugin's failure to sanitize and escape some of i...

PT-2023-31785 · WordPress · User Activity Log Pro

Name of the Vulnerable Software and Affected Versions: user-activity-log-pro WordPress plugin versions prior to 2.3.4 Description: The issue allows an attacker to manipulate the client IP address value by exploiting the plugin's retrieval of IP addresses from potentially untrusted headers. This c...

PT-2023-14385 · Ibm · Ibm Security Verify Privilege On-Premises

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Privilege On-Premises version 11.5 Description: A remote attacker could obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks...

PT-2023-25773 · WordPress · Activitypub

Name of the Vulnerable Software and Affected Versions: ActivityPub WordPress plugin versions prior to 1.0.0 Description: The issue allows any authenticated user to retrieve the title of arbitrary posts, including drafts and private ones, via an IDOR vector. This occurs because the plugin does not...

PT-2023-29669 · Unknown · Gilles Dumas

Name of the Vulnerable Software and Affected Versions: Gilles Dumas which template file plugin versions = 4.6.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on...

PT-2023-24739 · Easyuse · Easyuse Mailhunter Ultimate

Name of the Vulnerable Software and Affected Versions: EasyUse MailHunter Ultimate versions 2023 and earlier Description: The issue allows remote authenticated users to obtain sensitive system information, specifically the absolute path, via an unencrypted VIEWSTATE parameter in the create templa...

PT-2023-29477 · Unknown · Matt Mckenny Stout Google Calendar Plugin

Name of the Vulnerable Software and Affected Versions: Matt McKenny Stout Google Calendar plugin versions = 1.2.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the use...

PT-2023-29586 · Unknown · Christopher Finke Feed Statistics

Name of the Vulnerable Software and Affected Versions: Christopher Finke Feed Statistics plugin versions = 4.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...

PT-2023-30664 · WordPress · Dologin Security

Name of the Vulnerable Software and Affected Versions: DoLogin Security WordPress plugin versions prior to 3.7.1 Description: The issue concerns the DoLogin Security WordPress plugin, which does not restrict access to a widget showing IPs of failed logins to low-privileged users. This could...

PT-2023-28912 · Apache · Apache Inlong

Name of the Vulnerable Software and Affected Versions: Apache InLong versions 1.4.0 through 1.8.0 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability allows some sensitive parameter checks to be bypassed, including...

PT-2023-16843 · WordPress · Hotjar Plugin

Name of the Vulnerable Software and Affected Versions: Hotjar plugin for WordPress versions up to, and including, 1.0.15 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with administrator-level permissions to inject arbitrar...

PT-2023-25099 · Ibm · Ibm Cloud Pak For Business Automation

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Business Automation versions 18.0.0 through 22.0.2 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure...

PT-2023-32186 · Vrite · Vrite

Name of the Vulnerable Software and Affected Versions: vrite versions prior to 0.3.0 Description: The issue is related to the allocation of resources without limits or throttling in the GitHub repository vriteio/vrite. This could potentially lead to exploitation. Recommendations: For versions pri...