PT-2023-19061 · Tor +1 · Tor +1

Name of the Vulnerable Software and Affected Versions: Tor versions prior to 0.4.7.13 Description: The issue is related to a logic error in the SafeSocks option, where the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol. Recommendations: For versions prior to 0.4.7.13, update...

PT-2023-18546 · Izanami · Izanami

Name of the Vulnerable Software and Affected Versions: Izanami versions prior to 1.11.0 Description: The issue allows attackers to bypass authentication in the application when deployed using the official Docker image. This is due to a hard-coded secret used to sign the authentication token JWT,...

PT-2023-16156 · Alf.Io · Alf.Io

Name of the Vulnerable Software and Affected Versions: Alf.io versions prior to 2.0-M4-2301 Description: The issue is related to Cross-site Scripting XSS - Stored, which was found in the GitHub repository alfio-event/alf.io. This type of issue allows an attacker to inject malicious scripts into a...

PT-2023-18726 · Tiki · Tiki

Name of the Vulnerable Software and Affected Versions: Tiki versions prior to 24.1 Description: The issue allows PHP Object Injection in lib/sheet/grid.php due to an unserialize call when the Spreadsheets feature is enabled. Recommendations: For versions prior to 24.1, update to version 24.1 or...

PT-2023-16152

Name of the Vulnerable Software and Affected Versions pyload/pyload versions prior to 0.5.0b3.dev31 Description The issue concerns a code injection vulnerability in the pyload/pyload GitHub repository. It allows for pre-authentication remote code execution RCE due to the integration of JavaScript...

CVE-2023-22489 Flarum is missing authorization in discussion replies

Flarum is a discussion platform for websites. If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view the discussion is able to create a new reply via the REST API, no matter the reply permission or lock status. This includes users that...

PT-2023-15109 · Unknown · Helmet Store Showroom Site

Name of the Vulnerable Software and Affected Versions: Helmet Store Showroom Site version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/classes/Master.php?f=delete category" API endpoint. Recommendations:...

PT-2023-18545 · Unknown +1 · Mysql Server +2

Name of the Vulnerable Software and Affected Versions: a12nserver versions prior to 0.23.0 Description: The issue affects users of a12nserver who use MySQL, making them potentially vulnerable to SQL injection bugs. This could allow an attacker to obtain OAuth2 Access Tokens for unrelated users. T...

PT-2023-1003 · Linux +10 · Linux Kernel +10

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. The issue is related to missing locks in SNDRV CTL IOCTL ELEM READ|WRITE32 that can be used in a...

PT-2023-1170 · Vim +8 · Vim +8

Name of the Vulnerable Software and Affected Versions: Vim versions prior to 9.0.1189 Description: The issue is related to a heap-based buffer overflow in the Vim text editor, specifically in the src/normal.c component. This overflow occurs in dynamic memory and can be exploited to allow an...

CVE-2023-22488 Missing authorization in Flarum

Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification can be seen by the...

PT-2023-14936

Name of the Vulnerable Software and Affected Versions Harbor versions 1.X.X through 2.5.3 Description An access control issue allows attackers to access public and private image repositories without authentication. The vendor states this behavior is documented as a feature. There is no informatio...

PT-2023-16110 · Bits And Blooms · Bloom

Name of the Vulnerable Software and Affected Versions: bits-and-blooms/bloom versions prior to 3.3.1 Description: The issue is related to an Uncontrolled Search Path Element in the GitHub repository bits-and-blooms/bloom. Recommendations: For versions prior to 3.3.1, update to version 3.3.1 or...

PT-2023-14920 · Alotcer · Alotcer - Ar7088H-A

Name of the Vulnerable Software and Affected Versions: Alotcer - AR7088H-A firmware version 16.10.3 Description: The issue concerns an information disclosure where an unspecified error message contains the default administrator user name. Recommendations: For Alotcer - AR7088H-A firmware version...

CVE-2022-4696

There exists a use-after-free vulnerability in the Linux kernel through iouring and the IORINGOPSPLICE operation. If IORINGOPSPLICE is missing the IOWQWORKFILES flag, which signals that the operation won't use current-nsproxy, so its reference counter is not increased. This assumption is not alwa...

UBUNTU-CVE-2022-4696

There exists a use-after-free vulnerability in the Linux kernel through iouring and the IORINGOPSPLICE operation. If IORINGOPSPLICE is missing the IOWQWORKFILES flag, which signals that the operation won't use current-nsproxy, so its reference counter is not increased. This assumption is not alwa...

PT-2023-10544 · Smarthome · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer...

PT-2023-10538 · Pubnub +1 · Pubnub +1

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue concerns buffer overflow vulnerabilities in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow,...

PT-2023-12352 · Zephyr · Zephyr

Name of the Vulnerable Software and Affected Versions: Zephyr versions prior to 2.4.0 Description: The issue is related to a buffer overflow in the implementation of net buf add mem in the USB device Bluetooth class. Recommendations: For versions prior to 2.4.0, update to version 2.4.0 or later t...

PT-2023-10575 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer...