PT-2023-17183 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.20 Description: The issue is related to Cross-site Scripting XSS - Generic in the GitHub repository pimcore/pimcore. This is a type of security vulnerability that can allow an attacker to inject maliciou...

PT-2023-20257 · Unknown · Mehjabin Orthi Interactive Svg Image Map Builder

Name of the Vulnerable Software and Affected Versions: Mehjabin Orthi Interactive SVG Image Map Builder plugin versions = 1.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the...

PT-2023-2167 · Hitachi Energy · Sdm600

Name of the Vulnerable Software and Affected Versions: Hitachi Energy System Data Manager SDM600 versions prior to 1.2 FP3 HF4 Build Nr. 1.2.23000.291 Description: A vulnerability exists in the SDM600 endpoint, where an attacker could exploit this issue by running multiple parallel requests,...

PT-2023-2147 · Hitachi Energy · Sdm600

Name of the Vulnerable Software and Affected Versions: Hitachi Energy System Data Manager SDM600 versions prior to 1.2 FP3 HF4 Build Nr. 1.2.23000.291 Description: A vulnerability exists in the SDM600 API web services authorization validation implementation. An attacker who successfully exploits...

PT-2023-21865 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.5 Description: DataEase is an open source data visualization analysis tool where users can modify data, and data sources are expected to sanitize data properly. However, the AWS redshift data source does not...

PT-2023-13454 · Unknown · Matrix-React-Sdk

Name of the Vulnerable Software and Affected Versions: matrix-react-sdk versions prior to 3.53.0 Description: Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remaind...

PT-2023-2592 · Forgerock · Openid +1

Name of the Vulnerable Software and Affected Versions: OpenIDM and Java Remote Connector Server RCS versions 1.5.20.9 through 1.5.20.13 Description: The issue is related to the cleartext transmission of sensitive information, which can allow remote services to access protected information with...

PT-2023-21868 · Apiman · Apiman

Name of the Vulnerable Software and Affected Versions: Apiman versions prior to 3.1.0.Final Description: Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may gain access to API keys they do not have permission for if they correctly guess the URL, which...

PT-2023-21859

Name of the Vulnerable Software and Affected Versions lambdaisland/uri versions prior to 1.14.120 Description The issue allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri library, returning the wrong authority. This occurs because the authority-regex does not handle th...

PT-2023-21866 · Snappier · Snappier

Name of the Vulnerable Software and Affected Versions: Snappier version 1.1.0 Description: This is a buffer overrun vulnerability that can affect any user of Snappier 1.1.0. The issue arises from the use of byte references rather than pointers to pinned buffers, which can lead to invalid buffer...

PT-2023-16308 · WordPress · Hm Portfolio

Name of the Vulnerable Software and Affected Versions: HT Portfolio WordPress plugin versions prior to 1.1.6 Description: The issue concerns a lack of CSRF check when activating plugins, which could allow attackers to make logged-in admins activate arbitrary plugins present on the blog via a CSRF...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. When the parameter summarize of tf.rawops.Print is zero, the new method SummarizeArray will reference to a nullptr, leading to a seg fault. PoC import tensorflow as tf tf.rawops.Printinput = tf.constant1, 1, 1,...

PT-2023-17742 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to the onPrimaryClipChanged function in ClipboardListener.java, where incorrect UI is shown before setup completion, potentially allowing bypass of factory reset protection. This...

PT-2023-17802 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In multiple locations of p2p iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. Us...

PT-2023-21718 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: Dataease versions prior to 1.18.5 Description: The issue concerns the file upload interface in Dataease, where permissions are not properly checked, allowing users who are not logged in to upload files directly to the background. Additionally...

PT-2023-17837 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds read in the ConvertToHalMetadata function of aidl utils.cc due to a missing bounds check. This could lead to local information disclosure, requiring System execution...

PT-2023-17867 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds write due to a heap buffer overflow in the get svc hash function of nan.cpp. This could lead to local escalation of privilege with System execution privileges needed...

PT-2023-12657 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In the parseTrackFragmentRun function of MPEG4Extractor.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to remote escalation of privilege with no additional...

PT-2023-8787 · Veritas · Veritas Netbackup It Analytics

Name of the Vulnerable Software and Affected Versions: Veritas NetBackup IT Analytics versions prior to 11.2.0 Description: The issue is related to errors in cryptographic signature verification, which could allow a remote attacker to compromise data integrity. A malicious actor could exploit the...

PT-2023-12948 · Totolink · Totolink Outdoor Cpe Cp900

Name of the Vulnerable Software and Affected Versions: TOTOLink outdoor CPE CP900 version 6.3c.566 B20171026 Description: The issue concerns a command injection vulnerability in the setPasswordCfg function, which can be exploited via the adminuser and adminpass parameters. This allows attackers t...