PT-2023-21223 · Unknown · Codeigniter Shield

Name of the Vulnerable Software and Affected Versions: CodeIgniter Shield versions 1.0.0-beta.3 and earlier Description: An improper implementation was found in the password storage process, making all hashed passwords stored in affected versions easier to crack than expected. If an attacker...

PT-2023-16201 · Akuvox · Akuvox E11

Name of the Vulnerable Software and Affected Versions: Akuvox E11 affected versions not specified Description: The issue allows unauthenticated access to the camera capture for image and video, potentially enabling an attacker to view and record image and video from the camera. Recommendations: A...

PT-2023-16929 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.0.2 Description: The issue is related to improper restriction of rendered UI layers or frames. Recommendations: For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue...

PT-2025-18805

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.14.0-96.el9.x86 64 Description A vulnerability in the Linux kernel has been resolved, specifically in the scsi: qla2xxx module. The issue occurred when a command was completed in the abort path during driver...

Intel® Data Migration Software Advisory

Summary: A potential security vulnerability in Intel® Data Migration Software may allow escalation of privilege. Intel is not releasing updates to mitigate this potential vulnerability and has issued a Product Discontinuation Notice for Intel® Data Migration Software. Vulnerability Details: CVEID...

Intel® HAXM Advisory

Summary: A potential security vulnerability in the Intel® Hardware Accelerated Execution Manager HAXM software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-21812 Description: Improper access...

PT-2023-16911 · WordPress · Rapidload Power-Up For Autoptimize

Name of the Vulnerable Software and Affected Versions: RapidLoad Power-Up for Autoptimize plugin for WordPress versions up to, and including, 1.7.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ucss connect function. This allow...

PT-2023-16889 · Osticket · Osticket

Name of the Vulnerable Software and Affected Versions: osTicket versions prior to 1.16.6 Description: The issue is related to Cross-site Scripting XSS - Reflected, which affects the GitHub repository osticket/osticket. Recommendations: For versions prior to 1.16.6, update to version 1.16.6 or lat...

PT-2023-16904 · WordPress · Rapidload Power-Up For Autoptimize

Name of the Vulnerable Software and Affected Versions: RapidLoad Power-Up for Autoptimize plugin for WordPress versions up to, and including, 1.7.1 Description: The issue is related to a missing capability check on the ucss connect function, allowing authenticated attackers with subscriber-level...

PT-2023-19295 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to v6 Description: An improper access control issue exists that could allow an attacker to break the E2E encryption of a chat room by a user changing the group key of a chat room. Recommendations: For versions prior t...

GHSA-XM67-587Q-R2VW wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64

Impact Wasmtime's code generation backend, Cranelift, has a bug on x8664 platforms for the WebAssembly i8x16.select instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one...

PT-2023-21166 · Npm · Nextauth.Js

Name of the Vulnerable Software and Affected Versions: NextAuth.js versions prior to v4.20.1 Description: The issue allows a bad actor to intercept and tamper with the authorization URL, enabling them to log in as the victim and bypass CSRF protection. This occurs due to a partial failure during ...

PT-2023-21009 · Unknown · Online Pizza Ordering System

Name of the Vulnerable Software and Affected Versions: Online Pizza Ordering System version 1.0 Description: A cross-site scripting XSS issue in the /admin/navbar.php endpoint of the Online Pizza Ordering System allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

Upgraded Q -> 2 from #17 [1678363178694]

Judge has assessed an item in Issue 17 as 2 risk. The relevant finding follows: 5. Duplicated swingTrader addresses can be added which make sellMalt/buyMalt working incorrectly Details In function addSwingTrader, there is no check to ensure swingTrader address is not existed. So admin can make a...

TicketUtils: Number draws are not uniformly distributed

Lines of code Vulnerability details The number selection algorithm in TicketUtils.reconstructTicket "draws" winning numbers using modulo arithmetic and a random seed. However, selected numbers are not uniformly distributed. Due to modulo bias and successive draw logic, higher numbers will be draw...

PT-2023-16863 · Dsm · Enovia Live Collaboration

Name of the Vulnerable Software and Affected Versions: ENOVIA Live Collaboration version V6R2013xE Description: An XML External Entity injection XXE vulnerability allows an attacker to read local files on the server, which can also lead to Remote File inclusions. Recommendations: For ENOVIA Live...

Loss of funds when buying tickets with no frontend

Lines of code Vulnerability details When tickets are bought, the protocol allows to specify a frontend that will receive a percentage of the ticket fee as rewards 10% for the current setup. However, if this input is left empty during purchase, frontend rewards will still be counted and associated...

PT-2023-12206 · Wyomind · Wyomind Help Desk Magento 2 Extension

Name of the Vulnerable Software and Affected Versions: Wyomind Help Desk Magento 2 extension versions 1.3.6 and earlier Description: The issue allows an attacker to execute arbitrary code via a phar file upload in the ticket message field. This is achieved by exploiting a weakness in the...

PT-2023-13563 · Hewlett Packard · Hpe Superdome Flex Server +1

Name of the Vulnerable Software and Affected Versions: HPE Superdome Flex Servers versions prior to 3.65.8 HPE Superdome Flex 280 Servers versions prior to 1.45.8 Description: A potential security issue has been identified in HPE Superdome Flex and Superdome Flex 280 servers, which could be local...

PT-2023-12205 · Wyomind · Wyomind Help Desk Magento 2 Extension

Name of the Vulnerable Software and Affected Versions: Wyomind Help Desk Magento 2 extension versions 1.3.6 and before Description: The issue allows attackers to escalate privileges via a crafted payload in the ticket message field. This is a Cross Site Scripting vulnerability. Recommendations: F...