PT-2023-19243 · Steven Henty · Drop Shadow Boxes

Name of the Vulnerable Software and Affected Versions: Steven Henty Drop Shadow Boxes plugin versions 1.7.10 and earlier Description: The issue is related to an Authenticated Cross-Site Scripting XSS vulnerability. This means that an attacker with contributor or higher privileges can inject...

PT-2023-25597 · Cththemes · Cththemes Balkon

Name of the Vulnerable Software and Affected Versions: cththemes Balkon plugin versions 1.3.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for malicious scripts to be injected into web...

PT-2023-5946

Name of the Vulnerable Software and Affected Versions: copyparty versions prior to 1.8.7 Description: The application contains a reflected cross-site scripting vulnerability via URL-parameters ?k304=... and ?setck=.... This could allow an attacker to execute malicious javascript code by tricking...

PT-2023-22704

Name of the Vulnerable Software and Affected Versions Biltay Technology Scienta versions prior to 20230630.1953 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-25566 · WordPress · Wpxpo Postx – Gutenberg Post Grid Blocks

Name of the Vulnerable Software and Affected Versions: wpxpo PostX – Gutenberg Post Grid Blocks plugin versions = 2.9.9 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into ...

PT-2023-25596 · WordPress · Teachpress

Name of the Vulnerable Software and Affected Versions: teachPress plugin versions = 9.0.2 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading...

PT-2023-3876

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager Mobile EPMM versions prior to 11.10 Description The issue is related to an authentication bypass vulnerability in Ivanti Endpoint Manager Mobile EPMM, which allows unauthorized users to access restricted functionality o...

PT-2023-20474 · Atera · Atera Agent

Name of the Vulnerable Software and Affected Versions: Atera Agent versions 1.8.4.4 and prior Description: A privilege escalation issue was discovered due to the mishandling of privileged APIs. This issue affects Atera Agent on Windows. Recommendations: For Atera Agent versions 1.8.4.4 and prior,...

PT-2023-4209 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.5 Description: The issue is related to insufficient access control in the Voice Memos component of the macOS operating system. It may allow an attacker to gain unauthorized access to sensitive information. The...

PT-2023-26529 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.5 Description: An injection issue was addressed with improved input validation, allowing an app to potentially bypass certain Privacy preferences. Recommendations: For macOS versions prior to 13.5, update to macOS...

CVE-2023-3776 Use-after-free in Linux kernel's net/sched: cls_fw component

A use-after-free vulnerability in the Linux kernel's net/sched: clsfw component can be exploited to achieve local privilege escalation. If tcfchangeindev fails, fwsetparms will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter. If an attacker ca...

CVE-2023-3776 Use-after-free in Linux kernel's net/sched: cls_fw component

A use-after-free vulnerability in the Linux kernel's net/sched: clsfw component can be exploited to achieve local privilege escalation. If tcfchangeindev fails, fwsetparms will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter. If an attacker ca...

CVE-2023-3609 Use-after-free in Linux kernel's net/sched: cls_u32 component

A use-after-free vulnerability in the Linux kernel's net/sched: clsu32 component can be exploited to achieve local privilege escalation. If tcfchangeindev fails, u32setparms will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter. If an attacker...

CVE-2023-3609 Use-after-free in Linux kernel's net/sched: cls_u32 component

A use-after-free vulnerability in the Linux kernel's net/sched: clsu32 component can be exploited to achieve local privilege escalation. If tcfchangeindev fails, u32setparms will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter. If an attacker...

CVE-2023-37905

The CVE-2023-37905 entry concerns the CKEditor4 WordCount Plugin (ckeditor-wordcount-plugin). The issue is a cross-site scripting vulnerability that occurs when switching to source code mode. According to the provided documents, this vulnerability is addressed in version 1.17.12 of the plugin, an...

PT-2023-25132 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: Ivanti AntiVirus Product versions prior to 7.9.1.285 Description: An out-of-bounds write vulnerability on Windows operating systems causes the Ivanti AntiVirus Product to crash. Recommendations: Update to Ivanti AV Product version 7.9.1.285 o...

PT-2023-4402

Name of the Vulnerable Software and Affected Versions Open Babel versions 3.1.1 through master commit 530dbfa3 Description An out-of-bounds write issue exists in the CSR format title functionality. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a...

PT-2023-23816 · Dell · Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Wyse Management Suite versions prior to 4.0 Description: The issue is related to improper authorization, allowing an authenticated malicious user with privileged access to push policies to unauthorized tenant groups. Recommendations: For Wyse...

PT-2023-25941 · Google +1 · Google Chrome +1

Name of the Vulnerable Software and Affected Versions: Google Chrome on ChromeOS versions prior to 115.0.5790.131 Description: The issue is related to insufficient validation of untrusted input in Chromad, allowing a remote attacker to execute arbitrary code via a crafted shell script. The severi...

PT-2023-23815 · Dell · Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Wyse Management Suite versions prior to 4.0 Description: The issue allows an authenticated malicious user to flood the configured SMTP server with numerous requests, resulting in a denial-of-service. This can deny access to the system...