PT-2023-24878 · Unknown · Pleasanter

Name of the Vulnerable Software and Affected Versions: Pleasanter versions 1.3.47.0 and earlier Description: The issue is a stored cross-site scripting vulnerability. If exploited, it allows an arbitrary script to be executed on the user's web browser. Recommendations: For Pleasanter versions...

CVE-2023-41835 Apache Struts: excessive disk usage

When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which...

CVE-2023-41835 Apache Struts: excessive disk usage

When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which...

PT-2023-32310 · WordPress · Filr

Name of the Vulnerable Software and Affected Versions: Filr WordPress plugin version 1.2.3.6 and earlier Description: The issue allows for Remote Code Execution RCE, enabling the operating system to execute commands and fully compromise the server on behalf of a user with Author-level privileges...

PT-2023-8682 · Unknown · Scalefusion

Name of the Vulnerable Software and Affected Versions: ScaleFusion versions 10.5.2 through 10.5.6 Description: The issue is related to insufficient access control in the isolated environment of Scalefusion MDM Agent, which can be exploited to impact the confidentiality, integrity, and availabilit...

PT-2023-7313 · Zyxel · Zyxel Nas326 +1

Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 version V5.21AAZF.14C0 Zyxel NAS542 version V5.21ABAG.11C0 Description: A command injection issue exists in the show zysync server contents function, allowing an unauthenticated attacker to execute some operating system commands ...

PT-2023-31283 · Jenkins · Jenkins Neuvector Vulnerability Scanner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier Description: A cross-site request forgery CSRF vulnerability exists due to the lack of permission checks in a connection test HTTP endpoint, allowing attackers with...

PT-2023-36324 · Amazon · Ec2 Hibagent

Name of the Vulnerable Software and Affected Versions: EC2 hibagent versions prior to the update that adds IMDSv2 support Description: The issue concerns the use of an insecure protocol by IMDSv1, which is no longer recommended. The EC2 hibagent package has been updated to add IMDSv2 support...

PT-2023-29562 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version US AC10V4.0si V16.03.10.13 cn Description: A stack overflow issue was discovered via the list parameter in the sub 49E098 function. Recommendations: For Tenda AC10 version US AC10V4.0si V16.03.10.13 cn, consider restricting...

PT-2023-19518

Name of the Vulnerable Software and Affected Versions Zumtobel Netlink CCD Onboard version 3.74 Description A buffer overflow issue was discovered in the NetlinkWeb::Information::SetDeviceIdentification component. This issue affects the specified version of the Zumtobel Netlink CCD Onboard...

PT-2023-7939 · Linux +9 · Linux Kernel +9

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.7 Description: A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. The read size of a perf event can...

PT-2023-32568 · WordPress · Bookingpress

Name of the Vulnerable Software and Affected Versions: BookingPress plugin for WordPress versions up to, and including, 1.0.76 Description: The issue is related to insufficient file validation on the bookingpress process upload function, allowing authenticated attackers with administrator-level...

PT-2023-31035 · Tenda · Tenda Ax1803

Name of the Vulnerable Software and Affected Versions: Tenda AX1803 version 1.0.0.1 Description: The issue allows a remote attacker to execute arbitrary code via the schedStartTime parameter or the schedEndTime parameter in the function setSchedWifi. This enables the attacker to potentially gain...

PT-2023-32443 · WordPress · Post Smtp Mailer

Name of the Vulnerable Software and Affected Versions: POST SMTP Mailer WordPress plugin versions prior to 2.7.1 Description: The issue allows an unauthenticated attacker to perform XSS attacks against highly privileged users by not escaping email message content before displaying it in the...

PT-2023-28966 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to check if the "Allow users to view archived channels" setting is enabled when displaying permalink previews. This oversight allows members to...

PT-2023-30449 · Pachno · Pachno

Name of the Vulnerable Software and Affected Versions: Pachno version 1.0.6 Description: A vulnerability has been identified that allows an authenticated attacker to execute a cross-site scripting XSS attack. The issue exists due to inadequate input validation in the Project Description and...

PT-2023-31967 · WordPress · Cleantalk

Name of the Vulnerable Software and Affected Versions: CleanTalk WordPress plugin versions prior to 2.121 Description: The issue allows an attacker to manipulate the client IP address retrieved by the Security & Malware scan, potentially bypassing bruteforce protection. This is due to the plugin...

PT-2023-30718 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop opartdevis versions 4.5.18 through 4.6.12 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via a crafted script to the getModuleTranslation function. This enables the attacker to potentially...

PT-2023-28384 · WordPress · Eventprime

Name of the Vulnerable Software and Affected Versions: EventPrime WordPress plugin versions prior to 3.3.0 Description: The issue allows an attacker to purchase bookings without making a payment by manipulating the price specified in the client request. Recommendations: For versions prior to 3.3....

PT-2023-32291 · WordPress · Wordpress Backup & Migration

Name of the Vulnerable Software and Affected Versions: WordPress Backup & Migration WordPress plugin versions prior to 1.4.4 Description: The issue allows users with a role as low as Subscriber to update some plugin settings due to a lack of authorization for certain AJAX requests. Recommendation...