PT-2023-15308 · Pluginpress · Pluginpress Shortcode Imdb

Name of the Vulnerable Software and Affected Versions: PluginPress Shortcode IMDB versions 6.0.8 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-30238 · WordPress · Avirtum Imagelinks Interactive Image Builder

Name of the Vulnerable Software and Affected Versions: Avirtum ImageLinks Interactive Image Builder for WordPress versions 1.5.4 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows f...

PT-2023-19141 · Pixelgrade · Pixelgrade Comments Ratings Plugin

Name of the Vulnerable Software and Affected Versions: Pixelgrade Comments Ratings plugin versions prior to 1.1.8 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This type of vulnerability allows an attacker to...

PT-2023-10831 · Unknown · Vaerys-Dawn Discordsailv2

Name of the Vulnerable Software and Affected Versions: Vaerys-Dawn DiscordSailv2 versions up to 2.10.2 Description: A critical issue was found in the Tag Handler component, leading to improper access controls due to manipulation. This issue affects some unknown functionality of the component...

PT-2023-30350 · Proper Fraction Llc · Admin Bar & Dashboard Access Control

Name of the Vulnerable Software and Affected Versions: Proper Fraction LLC. Admin Bar & Dashboard Access Control plugin versions 1.2.8 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can...

PT-2023-32064 · WordPress · Awesome Support

Name of the Vulnerable Software and Affected Versions: Awesome Support WordPress plugin versions prior to 6.1.5 Description: The issue allows users to edit posts for which they do not have permission due to incorrect authorization of the wpas edit reply function. Recommendations: For versions pri...

PT-2023-27538 · Unknown · Contact Form 7 Custom Validation

Name of the Vulnerable Software and Affected Versions: Contact form 7 Custom validation versions n/a through 1.1.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

DoS (Denial of Service) io.netty:netty-codec-http2 in Confluence Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 7.19.0, 8.3.0, 8.4.0, 8.5.0, and 8.6.0 of Confluence Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H...

PT-2023-32434 · WordPress · Video Carousel Slider With Lightbox Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: video carousel slider with lightbox plugin for WordPress version 1.0 Description: The issue is due to missing or incorrect nonce validation on the responsive video gallery with lightbox video management func function, making it possible for...

Upgraded Q -> 2 from #175 [1699029356616]

Judge has assessed an item in Issue 175 as 2 risk. The relevant finding follows: L-02 Initial values for GovernorSettings are very low ODGovernor is a OZ Governor with some plugins. It sets up its parameters in the constructor: ODGovernor::constructor: File: src/contracts/gov/ODGovernor.sol 41:...

Important: openssl

Issue Overview: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. A truncation in the IV can result in non-uniqueness, which could result in loss of...

Important: libxml2

Issue Overview: libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can...

PT-2023-26892 · Strapi · Strapi

Name of the Vulnerable Software and Affected Versions: strapi versions prior to 4.13.1 Description: strapi is an open-source headless CMS. The issue arises from the improper restriction of write access to fields marked as private in the user registration endpoint. This allows malicious users to...

Important: samba

Issue Overview: Samba is vulnerable to path traversal due to insufficient sanitization of clients incoming pipe names. This can lead to the client connecting to as root to a Unix domain socket outside of the Samba private directory. CVE-2023-3961 SMB client can truncate files to 0 bytes by openin...

Upgraded Q -> 3 from #518 [1699029907154]

Judge has assessed an item in Issue 518 as 3 risk. The relevant finding follows: L-01 StakedAt time is not deleted during the issuance of prime tokens When a directly revocable token is issued, the stakedAt time of the user is deleted delete stakedAtusersi. This is not done when an irrevocable...

PT-2023-29509 · Unknown · Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: Online Food Ordering System version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. Specifically, the status parameter of the "routers/edit-orders.php" resource does not validate the characters...

PT-2023-32390 · Mattermost · Mattermost Desktop App

Name of the Vulnerable Software and Affected Versions: Mattermost Desktop affected versions not specified Description: The issue arises from Mattermost Desktop's failure to properly handle permissions or prompt the user for consent on certain sensitive ones, allowing media exploitation from a...

PT-2023-29521 · Unknown · Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: Online Food Ordering System version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities in the Online Food Ordering System. Specifically, the deleted parameter of the routers/user-router.php resource doe...

PT-2023-6691 · Bitrix +1 · Bitrix24 +1

Name of the Vulnerable Software and Affected Versions: Bitrix24 version 22.0.300 Description: The issue is related to prototype pollution in the bitrix/templates/bitrix24/components/bitrix/menu/left vertical/script.js component of Bitrix24. This allows remote attackers to execute arbitrary...

PT-2023-28469 · Unknown · Validationtools

Name of the Vulnerable Software and Affected Versions: validationtools affected versions not specified Description: The issue is related to a possible missing permission check in validationtools, which could lead to local information disclosure without requiring additional execution privileges...