PT-2023-26563 · Mindsdb +1 · Mindsdb +1

Name of the Vulnerable Software and Affected Versions: MindsDB versions prior to 23.7.4.0 Description: The issue concerns the MindsDB's AI Virtual Database, which allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with verify=False disabl...

PT-2023-20517 · Unknown · Underscore-Keypath

Name of the Vulnerable Software and Affected Versions: underscore-keypath versions 0.0.11 and later Description: The issue arises from improper input sanitization in the setProperty function, allowing the usage of arguments like proto and leading to Prototype Pollution. This can be exploited due ...

PT-2023-4123 · Zkteco · Zkteco Biotime

Name of the Vulnerable Software and Affected Versions: ZKTeco BioTime version 8.5.5 Description: The issue is related to a hidden API in the ZKTeco BioTime platform, which allows unauthenticated attackers to reset the Administrator password via a crafted web request. This can be exploited by a...

PT-2023-26560 · Unknown · Cypress-Image-Snapshot

Name of the Vulnerable Software and Affected Versions: cypress-image-snapshot versions prior to 8.0.2 Description: The issue allows a user to pass a relative file path for the snapshot name, potentially reaching outside of the project directory into the machine running the test. This can be...

PT-2023-24426 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.14 through 16.0.7 GitLab CE/EE versions 16.1 through 16.1.2 GitLab CE/EE versions 16.2 through 16.2.1 Description: A Regular Expression Denial of Service issue was discovered, allowing attackers to send crafted payload...

PT-2023-25043 · Poppler +5 · Poppler +5

Name of the Vulnerable Software and Affected Versions: Poppler versions prior to 23.06.0 Description: A vulnerability in Outline.cc for Poppler allows a remote attacker to cause a Denial of Service DoS crash via a crafted PDF file in OutlineItem::open. Recommendations: For versions prior to...

PT-2023-26395 · Saturday Drive · Ninja Forms

Name of the Vulnerable Software and Affected Versions: Ninja Forms versions 3.6.25 and earlier Description: The issue is related to a Missing Authorization vulnerability in Saturday Drive Ninja Forms. Recommendations: For versions 3.6.25 and earlier, update to a version later than 3.6.25 to resol...

Malicious actors could pass in huge arrays to disrupt service availability (DOS) in the updateVotingPower function

Lines of code Vulnerability details Impact The contract is stopped from being usable by legitimate users if the attacker repeatedly spammed large arrays Proof of Concept The updateVotingPower function currently only checks that the array is = 50: While 50 may be a reasonable limit for normal usag...

PT-2023-26737 · Unknown · Webmagic-Extension

Name of the Vulnerable Software and Affected Versions: webmagic-extension versions 0.9.0 and below Description: A code injection issue was discovered in the component us.codecraft.webmagic.downloader.PhantomJSDownloader. This allows for potential code injection attacks. Recommendations: For...

PT-2023-23787 · Apple · Music

Name of the Vulnerable Software and Affected Versions: Apple Music versions prior to 4.2.0 for Android Description: The issue allows an attacker in a privileged network position to intercept network traffic. This was addressed by using HTTPS when sending information over the network...

PT-2023-26484 · Node.Js · Sails

Name of the Vulnerable Software and Affected Versions: Sails versions prior to 1.5.7 Description: Sails is a realtime MVC Framework for Node.js. An attacker can send a virtual request that will cause the node process to crash. Recommendations: For versions prior to 1.5.7, update to version 1.5.7 ...

PT-2023-26224 · WordPress · Wpfunnels

Name of the Vulnerable Software and Affected Versions: WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plugin versions = 2.7.16 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker...

PT-2023-24469 · Teleadapt · Teleadapt Roomcast Ta-2400

Name of the Vulnerable Software and Affected Versions: TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1 Description: The issue concerns the use of a hard-coded password, also referred to as a PIN, with the values 385521, 843646, and 592671. Recommendations: For TeleAdapt RoomCast TA-2400...

PT-2023-26222 · WordPress · Radiustheme Variation Swatches For Woocommerce

Name of the Vulnerable Software and Affected Versions: RadiusTheme Variation Swatches for WooCommerce plugin versions prior to 2.3.8 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the...

PT-2023-14298 · Gx · Xperiencentral

Name of the Vulnerable Software and Affected Versions: GX Software XperienCentral versions 10.31.0 through 10.33.0 Description: The issue allows for cross-site request forgery CSRF due to the unique token being deducible from the names of all input fields. Recommendations: For GX Software...

PT-2023-26045 · Netdisco · Netdisco

Name of the Vulnerable Software and Affected Versions: Netdisco versions prior to 2.063000 Description: A cross-site scripting XSS issue was found in the /Web/TypeAhead.pm component. Recommendations: For versions prior to 2.063000, update to version 2.063000 or later to resolve the issue...

PT-2023-26959 · Mcafee · Epo

Name of the Vulnerable Software and Affected Versions: ePO versions prior to 5.10 SP1 Update 1 Description: A reflected cross-site scripting XSS vulnerability allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated eP...

PT-2023-26811 · Jenkins · Jenkins Qualys Web App Scanning Connector Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Qualys Web App Scanning Connector Plugin versions 2.0.10 and earlier Description: The issue arises from incorrect permission checks in the Jenkins Qualys Web App Scanning Connector Plugin, allowing attackers with global Item/Configure...

PT-2023-26345 · Trustwave +1 · Modsecurity +1

Name of the Vulnerable Software and Affected Versions: Trustwave ModSecurity versions 3.0.0 through 3.0.9 Description: The issue is related to Inefficient Algorithmic Complexity. Recommendations: For Trustwave ModSecurity versions 3.0.0 through 3.0.9, update to version 3.0.10 or later to resolve...

PT-2023-25112 · WordPress · Neha Goel Recent Posts Slider

Name of the Vulnerable Software and Affected Versions: Neha Goel Recent Posts Slider plugin versions = 1.1 Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be stored on the server and executed when a user accesses...