PT-2023-15058 · WordPress · Wp Trio Conditional Shipping For Woocommerce

Name of the Vulnerable Software and Affected Versions: Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin versions prior to 2.3.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user...

PT-2023-1306 · Moxa · Moxa Sds-3008 Series Industrial Ethernet Switch

Name of the Vulnerable Software and Affected Versions: Moxa SDS-3008 Series Industrial Ethernet Switch version 2.1 Description: A cleartext transmission issue exists in the web application functionality, allowing an attacker to obtain sensitive information by sniffing network traffic. This can le...

PT-2023-13489 · WordPress · Terawallet – For Woocommerce

Name of the Vulnerable Software and Affected Versions: TeraWallet – For WooCommerce plugin versions 1.3.24 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-22997 · Avideo · Avideo

Name of the Vulnerable Software and Affected Versions: AVideo versions prior to 12.4 Description: The issue allows for remote code execution when an attacker embeds a malicious video link. An attacker could execute remote code on a system running AVideo. The exploitation involves appending a...

PT-2023-14281 · Estsoft · Estsoft Alyac

Name of the Vulnerable Software and Affected Versions: ESTsoft Alyac version 2.5.8.645 Description: A denial of service issue exists in the malware scan functionality. This can be triggered by a specially-crafted PE file, leading to the termination of the target process. An attacker can exploit...

PT-2023-1424 · Adobe · Framemaker

Name of the Vulnerable Software and Affected Versions: Adobe FrameMaker versions 2020 Update 4 and earlier, 2022 and earlier Description: The issue is related to improper input validation, which could result in arbitrary code execution in the context of the current user. Exploitation requires use...

PT-2023-18429 · Bip-Ip · Bip-Ip

Name of the Vulnerable Software and Affected Versions: BIP-IP versions 13.1.x BIP-IP versions 14.1.x before 14.1.5.3 BIP-IP versions 15.1.x before 15.1.8.1 BIP-IP versions 16.1.x before 16.1.3.3 BIP-IP versions 17.0.x before 17.0.0.2 Description: When an OCSP authentication profile is configured ...

PT-2023-18453 · F5 · Big-Ip Edge Client

Name of the Vulnerable Software and Affected Versions: BIG-IP Edge Client versions 7.2.2 through 7.2.3.1 Description: A DLL hijacking issue exists in the BIG-IP Edge Client Windows Installer. This affects versions of the software starting from 7.2.2 up to but not including 7.2.3.1. Note that...

PT-2023-18851 · Selfwealth · Selfwealth Ios Mobile App

Name of the Vulnerable Software and Affected Versions: Selfwealth iOS mobile App version 3.3.1 Description: The issue concerns Insecure App Transport Security ATS Settings in the Selfwealth iOS mobile App. This means the app may not properly secure its communication, potentially allowing for...

PT-2023-18834 · Zoho · Zoho Asset Explorer

Name of the Vulnerable Software and Affected Versions: Zoho Asset Explorer version 6.9 Description: A Cross Site Scripting XSS issue exists in Zoho Asset Explorer via the credential name when creating a new Assets Workstation. This allows for potential malicious script execution. Recommendations:...

PT-2023-18832 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus version 14 Description: The issue is a cross site scripting XSS vulnerability. It affects the purchase component via PO. Recommendations: For Zoho ManageEngine ServiceDesk Plus version 14, update to a versio...

Losses in Pair and LendgineRouter can be generated if used with ERC20 Tokens with fee on transfer

Lines of code Vulnerability details Losses in Pair and LendgineRouter can be generated if used with ERC20 Tokens with fee on transfer Summary Some tokens token1, token0, ... are used over the code that can be any kind of ERC20 token. If this token includes fees on transfer, some operations will...

PT-2023-13033 · Cypress · Cypress Bluetooth Mesh Sdk

Name of the Vulnerable Software and Affected Versions: Cypress Bluetooth Mesh SDK version BSA0107 05.01.00-BX8-AMESH-08 Description: The issue is related to a buffer overflow that can allow the execution of arbitrary code remotely. It is caused by an out-of-bound write vulnerability in the lower...

Deserialization of untrusted data

In Apache Linkis =1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameter...

CVE-2022-44644 Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability

In Apache Linkis =1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, the parameters in the JDBC URL should be...

PT-2023-34842 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.89 Description: The issue is related to the dp aux cmd fifo tx function, where it may not be completed if the irq is not for aux transfer. The actual impact and attack plausibility have not yet been proven...

PT-2023-34890 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.229 Description: A potential security issue exists due to a warning during failed attribute validation in the act mpls component of the Linux Kernel's net/sched module. The actual impact and attack...

PT-2023-34766 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to io uring, where a lock overflowing occurs for IOPOLL. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2023-34790 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to an overflow before widen in the bitmap ip create function in the ipset module of the netfilter component. The actual impact and attack plausibility have not yet been...

PT-2023-34889 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.229 Description: The issue is related to the regulator, specifically the da9211, and its use of an irq handler when ready. The actual impact and attack plausibility have not yet been proven. Recommendations...