PT-2023-15174 · WordPress · Wp Cerber Security

Name of the Vulnerable Software and Affected Versions: WP Cerber Security plugin for WordPress versions up to, and including, 9.1 Description: The issue allows unauthenticated attackers to inject arbitrary web scripts in pages via the log parameter when logging in to the site. This makes it...

PT-2023-28150 · Unknown · Home Assistant

Name of the Vulnerable Software and Affected Versions: Home Assistant versions prior to 2023.9.0 Description: The issue affects Home Assistant, an open-source home automation system. Webhooks in the webhook component can be triggered via the .ui.nabu.casa URL without authentication, even when...

PT-2023-29219 · Home Assistant · Home Assistant Companion

Name of the Vulnerable Software and Affected Versions: Home Assistant Companion for iOS and macOS versions up to 2023.4 Description: The issue allows attackers to send malicious links or QRs to victims, which can lead to calling arbitrary services in their Home Assistant installation. This can...

PT-2023-6554 · Linux +9 · Linux Kernel +9

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events perf component can be exploited to achieve local privilege escalation. If perf read group...

PT-2023-28790 · Unknown · Evolution Evo

Name of the Vulnerable Software and Affected Versions: evolution evo version 3.2.3 Description: A cross-site scripting XSS issue allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter. This enables the attacker to perform unauthorized actions on the system...

PT-2023-29788 · Sourcecodester · Sourcecodester Best Courier Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Best Courier Management System version 1.0 Description: The issue concerns an arbitrary file upload vulnerability in the update user function. This allows for potential malicious file uploads. No information is provided about t...

PT-2023-29383 · Daisuke Takahashi · Opcache Dashboard Plugin

Name of the Vulnerable Software and Affected Versions: Daisuke TakahashiExtend Wings OPcache Dashboard plugin versions = 0.3.1 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentiall...

PT-2023-29608 · WordPress · Qrokes Qr Twitter Widget

Name of the Vulnerable Software and Affected Versions: QROkes QR Twitter Widget plugin versions 0.2.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication and affects users with contributor or higher...

PT-2023-29588 · WordPress · Hector Cabrera Wordpress Popular Posts

Name of the Vulnerable Software and Affected Versions: Hector Cabrera WordPress Popular Posts plugin versions prior to 6.3.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher privileges...

PT-2023-29791 · Sourcecodester · Sourcecodester Best Courier Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Best Courier Management System version 1.0 Description: The issue concerns SQL Injection via the id parameter in the "/edit staff.php" API endpoint. This allows for potential exploitation. Recommendations: For Sourcecodester Be...

PT-2023-29589 · Nicola Modugno · Smart Cookie Kit

Name of the Vulnerable Software and Affected Versions: Nicola Modugno Smart Cookie Kit plugin versions prior to 2.3.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher authentication level...

PT-2023-6560

Name of the Vulnerable Software and Affected Versions: Redis versions prior to 6.2.14 Redis versions prior to 7.0.14 Redis versions prior to 7.2.2 Description: Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permission...

CVE-2023-45803 Request body not stripped after redirect in urllib3

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...

PT-2023-6344 · Oracle · Oracle Outside In Technology

Name of the Vulnerable Software and Affected Versions: Oracle Outside In Technology versions 8.5.6 Description: The issue exists due to insufficient input validation in the Content Access SDK, Image Export SDK, PDF Export SDK, and HTML Export SDK components of Oracle Outside In Technology. This...

PT-2023-29770 · Unknown · Lylme Spage

Name of the Vulnerable Software and Affected Versions: lylme spage version 1.7.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the $userip parameter at function.php. Recommendations: For lylme spage version 1.7.0, consider restricting...

PT-2023-29344 · WordPress · Arrow Plugins Social Feed | Custom Feed For Social Media Networks

Name of the Vulnerable Software and Affected Versions: Arrow Plugins Social Feed | Custom Feed for Social Media Networks plugin versions = 2.2.0 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. No information is provided about the estimated number of...

PT-2023-29346 · Castos · Castos Seriously Simple Stats Plugin

Name of the Vulnerable Software and Affected Versions: Castos Seriously Simple Stats plugin versions = 1.5.1 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

PT-2023-29771 · Unknown · Lylme Spage

Name of the Vulnerable Software and Affected Versions: lylme spage version 1.7.0 Description: An arbitrary file upload vulnerability in the component ajax link.php of lylme spage allows attackers to execute arbitrary code via uploading a crafted file. Recommendations: For lylme spage version 1.7....

PT-2023-6343 · Oracle · Oracle Banking Trade Finance

Name of the Vulnerable Software and Affected Versions: Oracle Banking Trade Finance versions 14.5 through 14.7 Description: The issue is related to insufficient input validation in the Infrastructure component of Oracle Banking Trade Finance, allowing an unauthenticated attacker with network acce...

PT-2023-6202 · Mysql Server · Mysql Installer

Name of the Vulnerable Software and Affected Versions: MySQL Installer versions prior to 1.6.8 Description: The issue is related to insufficient input validation in the MySQL Installer product, specifically in the Installer: General component. This vulnerability can be easily exploited by a...