PT-2023-27908 · Sofarpc · Sofarpc

Name of the Vulnerable Software and Affected Versions: SOFARPC versions prior to 5.11.0 Description: SOFARPC is a Java RPC framework. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. The default configuration of the SOFARPC framework uses a...

PT-2023-5188 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: A vulnerability has been identified in the affected application, allowing users to upload arbitrary file types. This could allow an attacker to upload malicious files, potentially leading t...

PT-2023-28142 · Piccolo · Piccolo

Name of the Vulnerable Software and Affected Versions: Piccolo versions 0.120.0 and prior Description: The implementation of BaseUser.login in Piccolo leaks enough information to a malicious user, allowing them to generate a list of valid users on the platform. This list can be used in a password...

PT-2023-26156 · Unknown · Wing Ftp Server

Name of the Vulnerable Software and Affected Versions: Wing FTP Server versions = 7.2.0 Description: The issue is related to insecure storage of sensitive information in the User Web Client of Wing FTP Server, allowing information elicitation. Recommendations: For versions = 7.2.0, update to a...

PT-2023-27996 · Couchcms · Couchcms

Name of the Vulnerable Software and Affected Versions: CouchCMS version 2.3 Description: An open redirect issue exists in the sanitize url parameter, allowing attackers to redirect users to arbitrary websites via crafted URLs. Recommendations: For CouchCMS version 2.3, consider disabling the...

PT-2023-25451 · Phpjabbers · Phpjabbers Cleaning Business

Name of the Vulnerable Software and Affected Versions: PHPJabbers Cleaning Business Software version 1.0 Description: The issue concerns the lack of encryption on user passwords, allowing an attacker to gain access to all user accounts. This enables unauthorized access, potentially leading to dat...

PT-2023-31013 · WordPress · Crayon Syntax Highlighter

Name of the Vulnerable Software and Affected Versions: Crayon Syntax Highlighter plugin for WordPress versions up to, and including, 2.8.4 Description: The issue allows authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating from...

The validateCreateOrderHash function is vulnerable to an incorrect token type being provided by the caller

Lines of code Vulnerability details Impact Invalid token types could be used with encoded order info, breaking expectations of the contract. An attacker could create an order hash using different parameters than what is actually encoded in the orderInfo. This could potentially allow the attacker ...

Incorrect Handling of Empty rights Parameter in delegateAll Function

Lines of code Vulnerability details Description The delegateAll function does not correctly handle the case where the rights parameter is empty. In this case, the function will attempt to write an empty string to the Storage.POSITIONSRIGHTS storage location. This behavior could lead to unexpected...

PT-2023-28583 · WordPress · Masterstudy Lms Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: MasterStudy LMS WordPress Plugin versions prior to 3.0.18 Description: The issue allows anyone to register on the site as an instructor due to improper checks during registration. This enables them to add courses and/or posts. Recommendations...

PT-2023-27988 · Unknown · Dairy Farm Shop Management System Using Php/Mysql

Name of the Vulnerable Software and Affected Versions: Dairy Farm Shop Management System Using PHP and MySQL version 1.1 Description: The issue allows attackers to execute arbitrary web scripts and HTML via a crafted payload injected into the Category and Category Field parameters. This enables t...

Missing Ownership Check in mint Function

Lines of code Vulnerability details Description: The mint function in the PrincipalToken contract lacks a crucial ownership check before allowing token minting. While it correctly checks if the caller is the delegateToken contract to restrict minting to authorized contracts, it doesn't verify if...

PT-2023-26379 · Minitool · Minitool Partition Wizard

Name of the Vulnerable Software and Affected Versions: MiniTool Partition Wizard version 12.8 Description: The issue is related to an insecure update mechanism in MiniTool Partition Wizard, which can be exploited by attackers to achieve remote code execution through a man-in-the-middle attack...

PT-2023-30958 · Unknown · Instantsoft/Icms2

Name of the Vulnerable Software and Affected Versions: instantsoft/icms2 versions prior to 2.16.1-git Description: The issue is related to Server-Side Request Forgery SSRF in the GitHub repository instantsoft/icms2. This allows an attacker to make unauthorized requests on behalf of the server...

PT-2023-26380 · Minitool · Minitool Power Data Recovery

Name of the Vulnerable Software and Affected Versions: MiniTool Power Data Recovery versions 11.6 and before MiniTool Power Data Recovery version 11.5 Description: The issue concerns an insecure in-app payment system in MiniTool Power Data Recovery, which can be exploited through a...

PT-2023-27084 · Unknown · Free/Open Source Inventory Management System

Name of the Vulnerable Software and Affected Versions: Free and Open Source Inventory Management System version 1.0 Description: Multiple cross-site scripting XSS vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and...

PT-2023-7513 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 120.0.6099.62 Description: The issue is related to a use after free vulnerability in the Media Capture component of Google Chrome, which could potentially allow a remote attacker to exploit heap corruption...

PT-2023-25937 · Samsung · Exynos 2100 +3

Name of the Vulnerable Software and Affected Versions: Samsung Exynos Mobile Processor and Wearable Processor versions Exynos 980, Exynos 850, Exynos 2100, and Exynos W920 Description: An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor. Improper handling of length...

CVE-2023-41319 Remote Code Execution in Custom Integration Upload in Fides

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML...

CVE-2023-4244 Use-after-free in Linux kernel's netfilter: nf_tables component

A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. Due to a race condition between nftables netlink control plane transaction and nftset element garbage collection, it is possible to underflow the reference...