PT-2023-27036 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version B20210419 Description: A remote code execution issue was found in the setTracerouteCfg interface, allowing for potential code execution. Recommendations: For TOTOLINK X5000R version B20210419, consider restricting acce...

PT-2023-4780 · Notepad++ · Notepad++

Name of the Vulnerable Software and Affected Versions: Notepad++ versions 8.5.6 and prior Description: The issue is related to a heap buffer read overflow in the FileManager::detectLanguageFromTextBegining function. This may potentially be used to leak internal memory allocation information. The...

PT-2023-29208 · Inure · Inure

Name of the Vulnerable Software and Affected Versions: inure versions prior to build88 Description: The issue concerns a missing authorization in the GitHub repository hamza417/inure. Recommendations: For versions prior to build88, update to a version that includes the necessary authorization fix...

PT-2023-6794

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.9.23 Description The issue is related to the improper handling of session establishment errors in xrdp, allowing bypassing of OS-level session restrictions. The auth start session function can return a non-zero value o...

PT-2023-23616 · Fahad Mahmood · Fahad Mahmood Wp Docs

Name of the Vulnerable Software and Affected Versions: Fahad Mahmood WP Docs plugin versions prior to 1.9.9 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowi...

PT-2023-23613 · Theme Palace · Wp Education

Name of the Vulnerable Software and Affected Versions: Theme Palace TP Education plugin versions prior to 4.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This allows for malicious scripts to be...

PT-2023-23029 · Unknown · All My Web Needs Logo Scheduler

Name of the Vulnerable Software and Affected Versions: All My Web Needs Logo Scheduler plugin versions 1.2.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This vulnerability allows for malicious scripts ...

PT-2023-26681 · Unknown +2 · Carousel Wiget +3

Name of the Vulnerable Software and Affected Versions: CSZ CMS version 1.3.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section and choosing the carousel widget created above, in 'Photo URL' and 'YouTube...

PT-2023-22366 · Typora · Typora

Name of the Vulnerable Software and Affected Versions: Typora versions prior to 1.7.0-dev Description: The issue is related to improper path handling, which allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This can be exploited...

PT-2023-9232

Name of the Vulnerable Software and Affected Versions Rejetto HTTP File Server versions 2.3m and earlier Description The vulnerability is related to the improper neutralization of special elements used in a template engine, allowing a remote, unauthenticated attacker to execute arbitrary commands...

PT-2023-4453 · D Link · D-Link Dir-880L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-880 A1 FW107WWb08 Description: The issue is related to a buffer overflow in the fgets function of the D-Link DIR-880 router's firmware. This could allow a remote attacker to execute arbitrary code. Recommendations: For D-Link DIR-8...

PT-2023-21855 · Unknown · Easy Slider Revolution

Name of the Vulnerable Software and Affected Versions: Easy Slider Revolution plugin versions prior to 1.0.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, which can th...

PT-2023-4468 · D Link · D-Link Dir-880L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-880 A1 FW107WWb08 Description: The issue is related to a NULL pointer dereference in the FUN 00010824 function. This can potentially allow a remote attacker to cause a denial of service. Recommendations: For D-Link DIR-880 A1...

PT-2023-22181 · Apple · Pro Video Formats

Name of the Vulnerable Software and Affected Versions: Pro Video Formats versions prior to 2.2.5 Description: A logic issue was addressed with improved state management, which may allow a user to elevate privileges. Recommendations: For versions prior to 2.2.5, update to Pro Video Formats 2.2.5 t...

PT-2023-21909 · WordPress · Balasaheb Bhise Advanced Youtube Channel Pagination

Name of the Vulnerable Software and Affected Versions: Balasaheb Bhise Advanced Youtube Channel Pagination plugin version 1.0 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows for the injection of malicious...

PT-2023-7627 · Asustor · Asustor Data Master

Name of the Vulnerable Software and Affected Versions: ASUSTOR Data Master ADM versions 4.0.6.RIS1 through 4.1.0 ASUSTOR Data Master ADM versions 4.2.2.RI61 and below Description: The issue is related to improper neutralization of special elements used in a command, allowing remote unauthorized...

PT-2023-18557 · WordPress · Ko-Fi Button

Name of the Vulnerable Software and Affected Versions: Ko-fi Button WordPress plugin versions prior to 1.3.3 Description: The issue concerns the Ko-fi Button WordPress plugin, which does not properly handle some of its settings. This could allow high-privilege users to perform Stored Cross-Site...

PT-2023-27404 · Jenkins · Jenkins Shortcut Job Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Shortcut Job Plugin versions 0.4 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the Jenkins Shortcut Job Plugin does not escape the shortcut redirection URL, making ...

PT-2023-18663 · WordPress · Tiempo.Com Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Tiempo.com WordPress plugin versions 0.1.2 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the page parameter is not properly sanitised and escaped before being outputted back in th...

PT-2023-27401 · Jenkins · Jenkins Tuleap Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Tuleap Authentication Plugin versions 1.1.20 and earlier Description: The issue concerns a non-constant time comparison function used when validating an authentication token, allowing attackers to potentially use statistical methods t...