PT-2023-18659 · Unknown · Oopspam Anti-Spam Plugin

Name of the Vulnerable Software and Affected Versions: OOPSpam Anti-Spam plugin versions 1.1.35 and earlier Description: The issue is related to an Authenticated admin+ Cross-Site Scripting vulnerability. There is no information provided about the estimated number of potentially affected devices...

PT-2023-19103 · Mainwp · Mainwp Code Snippets Extension

Name of the Vulnerable Software and Affected Versions: MainWP MainWP Code Snippets Extension plugin versions prior to 4.0.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by authenticated users with subscriber or higher...

PT-2023-20074 · Klaviyo · Klaviyo

Name of the Vulnerable Software and Affected Versions: Klaviyo plugin versions 3.0.7 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scripts into the application,...

PT-2023-21900 · Jenkins · Jenkins Visual Studio Code Metrics Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Visual Studio Code Metrics Plugin versions 1.7 and earlier Description: The issue is related to the XML parser not being configured to prevent XML external entity XXE attacks. This allows attackers who can control VS Code Metrics File...

PT-2023-21891 · Jenkins · Jenkins Pipeline Aggregator View Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline Aggregator View Plugin versions 1.13 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because a variable representing the current view's URL is not properly escaped i...

PT-2023-21901 · Jenkins · Jenkins Performance Publisher Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Performance Publisher Plugin versions 8.09 and earlier Description: The issue is related to the XML parser not being configured to prevent XML external entity XXE attacks. This allows attackers who can control PerfPublisher report fil...

PT-2023-1973 · Tp Link · Tp-Link Mr3020

Name of the Vulnerable Software and Affected Versions: TP-Link MR3020 version 1 150921 Description: A command injection issue allows a remote attacker to execute arbitrary commands via a crafted request to the "tftp endpoint". This issue is related to the lack of data cleaning measures at the...

PT-2023-14546 · Unknown · Yannick Lefebvre Community Events

Name of the Vulnerable Software and Affected Versions: Yannick Lefebvre Community Events plugin versions = 1.4.8 Description: The issue is related to a Stored Cross-Site Scripting vulnerability that requires authentication with admin+ privileges. Recommendations: For versions = 1.4.8, update to a...

PT-2023-21719 · Tailscale · Tailscale

Name of the Vulnerable Software and Affected Versions: Tailscale versions 1.34.0 through 1.38.2 Description: A vulnerability in the implementation of Tailscale SSH on FreeBSD allows commands to be run with a higher privilege group ID than that specified in Tailscale SSH access rules. This issue...

PT-2023-21273 · Prestashop · Tshirtecommerce

Name of the Vulnerable Software and Affected Versions: tshirtecommerce aka Custom Product Designer component version 2.1.4 for PrestaShop Description: An issue was discovered in the tshirtecommerce component, where an HTTP request can be forged with a compromised tshirtecommerce design cart id GE...

PT-2023-17093 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.19 Description: The issue allows an attacker to perform SQL injection, potentially leading to full database access and possibly remote code execution RCE if the WEBROOT path is known. Recommendations: Fo...

PT-2023-21322 · Vox2Mesh · Vox2Mesh

Name of the Vulnerable Software and Affected Versions: vox2mesh version 1.0 Description: The issue is caused by a stack-overflow in the main.cpp file due to the incorrect use of the memcpy function. This allows an attacker to cause a denial of service abort via a crafted file. Recommendations: Fo...

Medium: systemd

Issue Overview: A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp. CVE-2021-3997 A vulnerability was found in systemd. This security flaw can cause a local information leak d...

PT-2023-17078 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue allows an attacker to learn the full name of a board owner due to Mattermost failing to check the "Show Full Name" setting when rendering the result for the...

PT-2023-21888 · WordPress · The Lead Generated Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Lead Generated WordPress Plugin version = 1.23 Description: The issue is related to an unauthenticated insecure deserialization problem. The tve labels parameter of the tve api form submit action is passed to the PHP unserialize function...

Important: httpd

Issue Overview: Some modproxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion o...

PT-2023-21882 · WordPress · Events Made Easy Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Events Made Easy WordPress Plugin version = 2.3.14 Description: The issue is an authenticated SQL injection vulnerability. It affects the search name parameter in the eme recurrences list action. Recommendations: For Events Made Easy WordPres...

PT-2023-14676 · Visam · Visam Vbase Automation Base

Name of the Vulnerable Software and Affected Versions: VISAM VBASE Automation Base versions prior to 11.7.5 Description: The issue may disclose information if a valid user opens a specially crafted file. This occurs due to improper handling of XML External Entity XXE processing in the file parsin...

PT-2023-16785 · Pacsrapor · Pacsrapor

Name of the Vulnerable Software and Affected Versions: Pacsrapor versions prior to 1.22 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection and Command Line Execution through S...

PT-2023-2353 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 Description: The issue is related to a path traversal vulnerability, which could allow an attacker to read local files, disclose plaintext credentials, and escalate privileges...