PT-2023-19931 · Apple +2 · Apple Macos +3

Name of the Vulnerable Software and Affected Versions: PowerPanel Business Local/Remote for Windows versions 4.8.6 and earlier PowerPanel Business Management for Windows versions 4.8.6 and earlier PowerPanel Business Local/Remote for Linux 32bit versions 4.8.6 and earlier PowerPanel Business...

PT-2023-16134 · WordPress · Weaver Xtreme Theme Support

Name of the Vulnerable Software and Affected Versions: Weaver Xtreme Theme Support WordPress plugin versions prior to 6.2.7 Description: The issue concerns a lack of validation and escaping of certain shortcode attributes, which could allow users with the contributor role and above to perform...

PT-2023-22825 · Kiwi Tcms · Kiwitcms/Kiwi +1

Name of the Vulnerable Software and Affected Versions: kiwitcms/Kiwi versions 12.2 and prior kiwitcms/enterprise versions 12.2 and prior Description: The changelog.yml workflow in Kiwi TCMS is vulnerable to command injection attacks due to the use of an untrusted github.head ref field. The...

PT-2023-19220 · Unknown · Davinder Singh Custom Settings Plugin

Name of the Vulnerable Software and Affected Versions: Davinder Singh Custom Settings plugin versions 1.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Davinder Singh Custo...

PT-2023-20071 · Wpchill · Wpchill Cpo Content Types

Name of the Vulnerable Software and Affected Versions: WPChill CPO Content Types plugin versions prior to 1.1.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For WPChill CPO Conte...

PT-2023-14523 · Unknown · 1App Business Forms

Name of the Vulnerable Software and Affected Versions: 1app Business Forms plugin versions prior to 1.0.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication, specifically with author or higher privileges. This vulnerability affects th...

PT-2023-19155 · WordPress · George Gecewicz Portfolio Slideshow

Name of the Vulnerable Software and Affected Versions: George Gecewicz Portfolio Slideshow plugin versions prior to 1.13.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This type of vulnerability allows...

CVE-2023-2241 PoDoFo PdfXRefStreamParserObject.cpp readXRefStreamEntry heap-based overflow

A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObject.cpp. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to th...

PT-2023-18482 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.3.4 Description: The issue involves exposure of private personal information to an unauthorized actor. This occurs in the GitHub repository microweber/microweber. Recommendations: For versions prior t...

CVE-2023-30620

The CVE-2023-30620 issue affects MindsDB where an unsafe extraction using tarfile.extractall() on a remotely retrieved tarball can write extracted files to unintended locations (TarSlip/ZipSlip-like). Affected MindsDB versions allowed remote tarball extraction without path validation, enabling ar...

PT-2023-22464 · H3C · H3C Magic R200

Name of the Vulnerable Software and Affected Versions: H3C Magic R200 version R200V100R004 Description: A stack overflow issue was discovered via the SetMobileAPInfoById interface at the "/goform/aspForm" API endpoint. This issue affects the H3C Magic R200 device. Recommendations: For H3C Magic...

PT-2023-22461 · H3C · H3C Magic R200

Name of the Vulnerable Software and Affected Versions: H3C Magic R200 version R200V100R004 Description: A stack overflow issue was discovered via the UpdateSnat interface at the "/goform/aspForm" API endpoint. This issue affects the H3C Magic R200 device. Recommendations: For H3C Magic R200 versi...

PT-2023-18393 · Modoboa · Modoboa

Name of the Vulnerable Software and Affected Versions: modoboa versions prior to 2.1.0 Description: The issue is related to Cross-Site Request Forgery CSRF in the modoboa repository. An attacker must be logged in as an admin to exploit this issue. Recommendations: For versions prior to 2.1.0,...

PT-2023-18187 · Nunjucks +1 · Nunjucks +1

Name of the Vulnerable Software and Affected Versions: Nunjucks versions prior to 3.2.4 Description: The issue allows bypassing the restrictions provided by the autoescape functionality in Nunjucks. If two user-controlled parameters are on the same line in the views, it is possible to inject...

PT-2023-22813 · WordPress · Form Block

Name of the Vulnerable Software and Affected Versions: Form block versions prior to 1.0.2 Description: The Form block WordPress plugin is subject to a Cross-Site Request Forgery CSRF due to a missing nonce check. This allows requests to be sent to forms from any website without the user's...

PT-2023-12993 · Onos · Onos

Name of the Vulnerable Software and Affected Versions: ONOS version 2.5.1 Description: An issue was discovered in ONOS where there is an incorrect comparison of paths installed by intents. An existing intent does not redirect to a new path, even if a new intent that shares the path with higher...

PT-2023-12274 · Unknown · Mobicint Backend For Credit Unions

Name of the Vulnerable Software and Affected Versions: Mobicint Backend for Credit Unions version 3 Description: An issue in the software allows attackers to retrieve partial email addresses and user-entered information via submission to the "forgotten-password endpoint". Recommendations: For...

PT-2023-20947 · Teacms · Teacms

Name of the Vulnerable Software and Affected Versions: TeaCMS affected versions not specified Description: A Cross Site Scripting issue in TeaCMS storage allows an attacker to cause a leak of sensitive information via the article title parameter. This enables the attacker to potentially access or...

PT-2023-9256

Name of the Vulnerable Software and Affected Versions Gogs versions 0.13.0 and earlier Description The built-in SSH server of Gogs allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending ...

PT-2023-21732 · Pretalx · Pretalx

Name of the Vulnerable Software and Affected Versions: pretalx versions 2.3.1 through 2.3.1 Description: The issue allows path traversal in HTML export, a non-default feature. Users can upload crafted HTML documents that trigger the reading of arbitrary files. Recommendations: For pretalx version...