PT-2023-12675 · Opensuse · Opensuse

Name of the Vulnerable Software and Affected Versions: openSUSE paste versions prior to b57b9f87e303a3db9465776e657378e96845493b Description: An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' issue allows remote attackers to place Javascript into SVG files...

PT-2023-16470 · WordPress · Wicked Folders

Name of the Vulnerable Software and Affected Versions: Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description: The issue is related to a missing capability check on the ajax add folder function, allowing authenticated attackers with subscriber-level permissions and...

PT-2023-19809 · Onedev · Onedev

Name of the Vulnerable Software and Affected Versions: Onedev versions prior to 7.9.12 Description: Onedev is a self-hosted Git Server with CI/CD and Kanban. The algorithm used to generate access token and password reset keys was not cryptographically secure in versions prior to 7.9.12. Existing...

PT-2023-1353 · Dompdf +2 · Dompdf +2

Name of the Vulnerable Software and Affected Versions: Dompdf versions prior to 2.0.3 Description: The issue arises from the difference in attribute parsing between Dompdf and php-svg-lib, allowing an attacker to call arbitrary URLs with arbitrary protocols. Dompdf respects the xlink:href attribu...

DEBIAN-CVE-2023-23942

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation...

CVE-2014-125086

A vulnerability has been found in Gimmie Plugin 1.2.2 on vBulletin and classified as critical. Affected by this vulnerability is an unknown functionality of the file triggerlogin.php. The manipulation of the argument userid leads to sql injection. Upgrading to version 1.3.0 is able to address thi...

PT-2023-12969 · Afterpay · Afterpay Gateway For Woocommerce

Name of the Vulnerable Software and Affected Versions: Afterpay Gateway for WooCommerce versions prior to 3.5.1 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into a website, potentially leading to...

PT-2023-14713 · Talend · Talend Esb Runtime

Name of the Vulnerable Software and Affected Versions: Talend ESB Runtime versions prior to 8.0.1-R2022-10-RT Talend ESB Runtime versions prior to 7.3.1-R2022-09-RT Description: The issue concerns SQL Injection attacks in the provisioning service of the Talend ESB Runtime. Users of the provisioni...

PT-2023-12266 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud devices before OS5 Description: The issue concerns a nobody account with a blank password in Western Digital My Cloud devices. Recommendations: For Western Digital My Cloud devices before OS5, consider changing the...

PT-2023-16422

Name of the Vulnerable Software and Affected Versions libjxl versions prior to 0.8.1 Description An out of bounds read exists in libjxl. An attacker using a specifically crafted file could cause an out of bounds read in the exif handler. Recommendations For versions prior to 0.8.1, we recommend...

Post-Macro World Sees Rise in Microsoft OneNote Documents Delivering Malware

In a continuing sign that threat actors are adapting well to a post-macro world, it has emerged that the use of Microsoft OneNote documents to deliver malware via phishing attacks is on the rise. Some of the notable malware families that are being distributed using this method include AsyncRAT,...

PT-2023-12325 · Automad · Automad

Name of the Vulnerable Software and Affected Versions: automad version 1.7.5 Description: A Cross Site Scripting XSS issue allows remote attackers to run arbitrary code via the user name field when adding a user. Recommendations: For automad version 1.7.5, update to a version that contains a fix...

PT-2023-14160 · Unknown · Wepa Print Away

Name of the Vulnerable Software and Affected Versions: WEPA Print Away affected versions not specified Description: The issue concerns a stored XSS that occurs due to improper sanitization of uploaded filenames. An attacker can deceive a user into uploading a document with a malicious filename...

PT-2023-12326 · Unknown · Vimium Extension

Name of the Vulnerable Software and Affected Versions: Vimium Extension versions 1.66 and earlier Description: A Universal Cross Site Scripting UXSS issue in the omnibar feature allows remote attackers to run arbitrary code. Recommendations: For versions 1.66 and earlier, update to a version late...

PT-2023-12289 · Kitecms · Kitecms

Name of the Vulnerable Software and Affected Versions: KiteCMS version 1.1 Description: An issue with access control in KiteCMS allows remote attackers to view sensitive information by manipulating the path in the application URL. Recommendations: For KiteCMS version 1.1, update to a version that...

PT-2023-12285 · Gurock · Gurock Testrail

Name of the Vulnerable Software and Affected Versions: Gurock TestRail versions prior to 7.1.2 Description: The issue allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports. This is a Cross Site Scripting XSS issue...

Code breaks if first user is not expected user

Lines of code Vulnerability details Code breaks if first user is not expected user Summary Rather than iterate and continue if user is not the expected one, this code breaks all the execution if first user is userId Vulnerability Detail Execution is broke most of the times at first iteration for ...

PT-2023-19305 · Opendds · Opendds

Name of the Vulnerable Software and Affected Versions: OpenDDS versions prior to 3.23.1 Description: The issue affects OpenDDS applications exposed to untrusted RTPS network traffic, which may cause them to crash when parsing badly-formed input. Recommendations: For versions prior to 3.23.1, upda...

PT-2023-19435 · Totolink · Totolink Ca300-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884 Description: A command injection issue was discovered via the minute parameter in the setRebootScheCfg function. This allows for potential command injection attacks. Recommendations: For TOTOLINK CA300-PoE...

PT-2023-15058 · WordPress · Wp Trio Conditional Shipping For Woocommerce

Name of the Vulnerable Software and Affected Versions: Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin versions prior to 2.3.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user...