PT-2023-24426 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.14 through 16.0.7 GitLab CE/EE versions 16.1 through 16.1.2 GitLab CE/EE versions 16.2 through 16.2.1 Description: A Regular Expression Denial of Service issue was discovered, allowing attackers to send crafted payload...

PT-2023-25043 · Poppler +5 · Poppler +5

Name of the Vulnerable Software and Affected Versions: Poppler versions prior to 23.06.0 Description: A vulnerability in Outline.cc for Poppler allows a remote attacker to cause a Denial of Service DoS crash via a crafted PDF file in OutlineItem::open. Recommendations: For versions prior to...

PT-2023-26395 · Saturday Drive · Ninja Forms

Name of the Vulnerable Software and Affected Versions: Ninja Forms versions 3.6.25 and earlier Description: The issue is related to a Missing Authorization vulnerability in Saturday Drive Ninja Forms. Recommendations: For versions 3.6.25 and earlier, update to a version later than 3.6.25 to resol...

Malicious actors could pass in huge arrays to disrupt service availability (DOS) in the updateVotingPower function

Lines of code Vulnerability details Impact The contract is stopped from being usable by legitimate users if the attacker repeatedly spammed large arrays Proof of Concept The updateVotingPower function currently only checks that the array is = 50: While 50 may be a reasonable limit for normal usag...

PT-2023-26737 · Unknown · Webmagic-Extension

Name of the Vulnerable Software and Affected Versions: webmagic-extension versions 0.9.0 and below Description: A code injection issue was discovered in the component us.codecraft.webmagic.downloader.PhantomJSDownloader. This allows for potential code injection attacks. Recommendations: For...

PT-2023-23787 · Apple · Music

Name of the Vulnerable Software and Affected Versions: Apple Music versions prior to 4.2.0 for Android Description: The issue allows an attacker in a privileged network position to intercept network traffic. This was addressed by using HTTPS when sending information over the network...

PT-2023-26224 · WordPress · Wpfunnels

Name of the Vulnerable Software and Affected Versions: WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plugin versions = 2.7.16 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker...

PT-2023-26484 · Node.Js · Sails

Name of the Vulnerable Software and Affected Versions: Sails versions prior to 1.5.7 Description: Sails is a realtime MVC Framework for Node.js. An attacker can send a virtual request that will cause the node process to crash. Recommendations: For versions prior to 1.5.7, update to version 1.5.7 ...

PT-2023-24469 · Teleadapt · Teleadapt Roomcast Ta-2400

Name of the Vulnerable Software and Affected Versions: TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1 Description: The issue concerns the use of a hard-coded password, also referred to as a PIN, with the values 385521, 843646, and 592671. Recommendations: For TeleAdapt RoomCast TA-2400...

PT-2023-26222 · WordPress · Radiustheme Variation Swatches For Woocommerce

Name of the Vulnerable Software and Affected Versions: RadiusTheme Variation Swatches for WooCommerce plugin versions prior to 2.3.8 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the...

PT-2023-26045 · Netdisco · Netdisco

Name of the Vulnerable Software and Affected Versions: Netdisco versions prior to 2.063000 Description: A cross-site scripting XSS issue was found in the /Web/TypeAhead.pm component. Recommendations: For versions prior to 2.063000, update to version 2.063000 or later to resolve the issue...

PT-2023-14298 · Gx · Xperiencentral

Name of the Vulnerable Software and Affected Versions: GX Software XperienCentral versions 10.31.0 through 10.33.0 Description: The issue allows for cross-site request forgery CSRF due to the unique token being deducible from the names of all input fields. Recommendations: For GX Software...

PT-2023-26345 · Trustwave +1 · Modsecurity +1

Name of the Vulnerable Software and Affected Versions: Trustwave ModSecurity versions 3.0.0 through 3.0.9 Description: The issue is related to Inefficient Algorithmic Complexity. Recommendations: For Trustwave ModSecurity versions 3.0.0 through 3.0.9, update to version 3.0.10 or later to resolve...

PT-2023-26811 · Jenkins · Jenkins Qualys Web App Scanning Connector Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Qualys Web App Scanning Connector Plugin versions 2.0.10 and earlier Description: The issue arises from incorrect permission checks in the Jenkins Qualys Web App Scanning Connector Plugin, allowing attackers with global Item/Configure...

PT-2023-26959 · Mcafee · Epo

Name of the Vulnerable Software and Affected Versions: ePO versions prior to 5.10 SP1 Update 1 Description: A reflected cross-site scripting XSS vulnerability allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated eP...

PT-2023-5946

Name of the Vulnerable Software and Affected Versions: copyparty versions prior to 1.8.7 Description: The application contains a reflected cross-site scripting vulnerability via URL-parameters ?k304=... and ?setck=.... This could allow an attacker to execute malicious javascript code by tricking...

PT-2023-25112 · WordPress · Neha Goel Recent Posts Slider

Name of the Vulnerable Software and Affected Versions: Neha Goel Recent Posts Slider plugin versions = 1.1 Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be stored on the server and executed when a user accesses...

PT-2023-19243 · Steven Henty · Drop Shadow Boxes

Name of the Vulnerable Software and Affected Versions: Steven Henty Drop Shadow Boxes plugin versions 1.7.10 and earlier Description: The issue is related to an Authenticated Cross-Site Scripting XSS vulnerability. This means that an attacker with contributor or higher privileges can inject...

PT-2023-25597 · Cththemes · Cththemes Balkon

Name of the Vulnerable Software and Affected Versions: cththemes Balkon plugin versions 1.3.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for malicious scripts to be injected into web...

PT-2023-22704

Name of the Vulnerable Software and Affected Versions Biltay Technology Scienta versions prior to 20230630.1953 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...