PT-2023-4217 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda FH1203 version 2.0.1.6 Description: The issue is related to a stack overflow in the addWifiMacFilter function, which can be triggered via the deviceId parameter. This could allow a remote attacker to execute arbitrary code...

PT-2023-25321 · Squidex · Squidex

Name of the Vulnerable Software and Affected Versions: Squidex versions prior to 7.4.0 Description: The issue is related to the improper handling of an additional special element in the GitHub repository squidex/squidex. Recommendations: For versions prior to 7.4.0, update to version 7.4.0 or lat...

PT-2023-18639 · Unknown · Bigcontact Contact Page Plugin

Name of the Vulnerable Software and Affected Versions: BigContact Contact Page plugin versions 1.5.8 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...

PT-2023-3889 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda FH1203 version V2.0.1.6 Description: The issue is related to a stack overflow in the fromVirtualSer function, which can be exploited to cause a denial of service. This can be achieved by manipulating the page parameter. The estimated...

PT-2023-25293 · Pimcore · Pimcore/Customer-Data-Framework

Name of the Vulnerable Software and Affected Versions: pimcore/customer-data-framework versions prior to 3.4.1 Description: The product performs authorization checks incorrectly, allowing an unauthorized actor to access resources or perform actions. This enables the attacker to view and freely ad...

PT-2023-26174 · Ckeditor +1 · Ckeditor-Wordcount-Plugin +2

Name of the Vulnerable Software and Affected Versions: ckeditor-wordcount-plugin versions prior to 1.17.12 Description: The ckeditor-wordcount-plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. In default scenarios, exploiting this vulnerability...

PT-2023-20096 · Unknown · Jason Rouet Weather Station

Name of the Vulnerable Software and Affected Versions: Jason Rouet Weather Station plugin versions = 3.8.12 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on the web...

PT-2023-23290 · WordPress · Mstore Api

Name of the Vulnerable Software and Affected Versions: MStore API WordPress plugin versions prior to 3.9.7 Description: The issue concerns the MStore API WordPress plugin, which does not implement sufficient security measures for its AJAX actions. Specifically, it lacks privilege checks, nonce...

PT-2023-5378 · D Link · Di-7200Gv2.E1

Name of the Vulnerable Software and Affected Versions: D-Link device DI-7200GV2.E1 version 21.04.09E1 Description: The issue is related to a stack overflow in the tgfile.asp function when processing the fn parameter. This can allow a remote attacker to impact the confidentiality, integrity, and...

PT-2023-22696

Name of the Vulnerable Software and Affected Versions Tise Technology Parking Web Report versions prior to 2.1 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-5225 · Ibm · Ibm Db2 Jdbc Driver

Name of the Vulnerable Software and Affected Versions: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows versions 10.5, 11.1, and 11.5 Description: The issue is related to incorrect code generation management in the IBM DB2 JDBC driver, which could allow a remote authenticated attacker to...

PT-2023-5228 · Ibm · Ibm Db2 Jdbc Driver

Name of the Vulnerable Software and Affected Versions: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows versions 10.5, 11.1, and 11.5 Description: The issue is related to incorrect code generation management in the IBM DB2 database management system's JDBC client driver. It allows a remote...

PT-2023-25365 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 8.5 through 9.0 Description: The issue is caused by improper encoding in a local configuration file, which could provide weaker than expected security. Recommendations: For IBM WebSphere Application...

PT-2023-25203 · Outline · Outline

Name of the Vulnerable Software and Affected Versions: outline/outline versions prior to 0.70.1 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation or escaping, allowing an...

GHSA-6628-Q6J9-W8VG gRPC Reachable Assertion issue

There exists an vulnerability causing an abort to be called in gRPC. The following headers cause gRPC's C++ implementation to abort when called via http2: te: x x != trailers :scheme: x x != http, https grpclbclientstats: x x == anything On top of sending one of those headers, a later header must...

GHSA-M9P2-J4HG-G373 Apache Cassandra: Privilege escalation when enabling FQL/Audit logs

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be...

PT-2023-20516 · Unknown · Drogonframework/Drogon

Name of the Vulnerable Software and Affected Versions: drogonframework/drogon versions prior to the fixed version Description: The issue arises when untrusted user input is used to set request headers in the addHeader function, allowing an attacker to inject additional headers by adding r carriag...

PT-2023-24729 · Zimbra · Zimbra Zcs

Name of the Vulnerable Software and Affected Versions: Zimbra ZCS version 8.8.15 Description: The issue allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function. Recommendations: For Zimbra ZCS version 8.8.15, consider...

PT-2023-5173 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: The issue is caused by a buffer overflow in the firewall handler set function, allowing a remote attacker to execute arbitrary code. A specially crafted HTTP request can trigger this issue,...

PT-2023-5151 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L versions 32.3.0.5 Description: The issue is caused by a buffer overflow vulnerability in the set qos function of the Milesight UR32L's vtysh ubus binary, due to the use of an unsafe sprintf pattern. This can be exploited by...