PT-2023-20404 · Totalsoft · Video Gallery

Name of the Vulnerable Software and Affected Versions: Video Gallery by Total-Soft Video Gallery plugin versions 1.7.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: Fo...

PT-2023-19241 · WordPress · Profilepress Membership Team Profilepress

Name of the Vulnerable Software and Affected Versions: ProfilePress Membership Team ProfilePress plugin versions = 4.5.4 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into...

PT-2023-19273 · Unknown +1 · Himanshu Bing Site Verification +1

Name of the Vulnerable Software and Affected Versions: Himanshu Bing Site Verification plugin using Meta Tag plugin version 1.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability...

CVE-2023-2475 Dromara J2eeFAST System Message cross site scripting

A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic. This issue affects some unknown processing of the component System Message Handler. The manipulation of the argument 主题 leads to cross site scripting. The attack may be initiated remotely. The exploit has bee...

PT-2023-23323 · Evasys · Evasys

Name of the Vulnerable Software and Affected Versions: evasys versions prior to 8.2 Build 2286 evasys versions 9.x prior to 9.0 Build 2401 Description: The issue concerns the lack of input validation for certain parameters in evasys, specifically nutzer titel, nutzer vn, nutzer nn, langID, and...

PT-2023-17291 · WordPress · Limit Login Attempts

Name of the Vulnerable Software and Affected Versions: Limit Login Attempts WordPress plugin versions 1.7.2 and earlier Description: The issue concerns the Limit Login Attempts WordPress plugin, where it fails to sanitize and escape usernames when outputting them back in the logs dashboard. This...

PT-2023-15507 · Jedox · Jedox

Name of the Vulnerable Software and Affected Versions: Jedox versions 2020.2.5 Description: A Directory Traversal issue in the /be/erpc.php endpoint allows remote authenticated users to execute arbitrary code. Recommendations: For version 2020.2.5, consider restricting access to the /be/erpc.php...

PT-2023-19784 · Unknown · Appium-Desktop

Name of the Vulnerable Software and Affected Versions: appium-desktop versions prior to 1.22.3-4 Description: The issue is an OS Command Injection, which affects the GitHub repository appium/appium-desktop. Recommendations: For versions prior to 1.22.3-4, update to version 1.22.3-4 or later to...

CVE-2023-2235 Use-after-free in Linux kernel's Performance Events subsystem

A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perfgroupdetach function did not check the event's siblings' attachstate before calling addeventtogroups, but removeonexec made it possible to call listdelevent...

CVE-2023-2235 Use-after-free in Linux kernel's Performance Events subsystem

A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perfgroupdetach function did not check the event's siblings' attachstate before calling addeventtogroups, but removeonexec made it possible to call listdelevent...

CVE-2023-2236 Use-after-free in Linux kernel's Performance Events subsystem

A use-after-free vulnerability in the Linux Kernel iouring subsystem can be exploited to achieve local privilege escalation. Both ioinstallfixedfile and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability. We recommend...

CVE-2023-2236 Use-after-free in Linux kernel's Performance Events subsystem

A use-after-free vulnerability in the Linux Kernel iouring subsystem can be exploited to achieve local privilege escalation. Both ioinstallfixedfile and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability. We recommend...

Inadequate Encryption Strength

Overview trustwallet/wallet-core is a mobile-focused library implementing low-level cryptographic wallet functionality for a high number of blockchains Affected versions of this package are vulnerable to Inadequate Encryption Strength in its mt19937 seed generation, which has only 32 bits of...

PT-2023-23015 · Triton +2 · Triton +2

Name of the Vulnerable Software and Affected Versions: Triton versions prior to 3.8.4 Description: The issue affects the Triton Minecraft plugin for Spigot and BungeeCord, allowing execution of commands on the spigot/bukkit console through the CustomPayload packet. When bungee mode is enabled in...

PT-2023-21201 · Ibm · Ibm Counter Fraud Management For Safer Payments

Name of the Vulnerable Software and Affected Versions: IBM Counter Fraud Management for Safer Payments versions 6.1.0.00 through 6.1.1.02 IBM Counter Fraud Management for Safer Payments versions 6.2.0.00 through 6.2.2.02 IBM Counter Fraud Management for Safer Payments versions 6.3.0.00 through...

Code injection

Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issues when compiled...

PT-2023-12779 · Infopop · Infopop Ultimate Bulletin Board

Name of the Vulnerable Software and Affected Versions: Infopop Ultimate Bulletin Board versions up to 5.47a Description: The issue allows all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature. Recommendations: For Infopop Ultimate Bulletin...

PT-2023-22642 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: Emlog Pro version 2.0.3 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters. This enables the execution of malicious scripts,...

PT-2023-18931 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.21 Description: This issue is related to Cross-site Scripting XSS - Reflected, which has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cook...

CVE-2023-0458

A speculative pointer dereference problem exists in the Linux Kernel on the doprlimit function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or...