PT-2023-12511 · WordPress · Edwiser Bridge

Name of the Vulnerable Software and Affected Versions: Edwiser Bridge plugin for WordPress versions up to, and including, 2.0.6 Description: The issue is due to missing or incorrect nonce validation on several functions, including user data synchronization initiater, course synchronization...

PT-2023-4738

Name of the Vulnerable Software and Affected Versions tough-cookie versions prior to 4.1.3 Description The issue arises from improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode, leading to Prototype Pollution. This vulnerability is related to insufficient control...

PT-2023-11876 · Cartflows · Woocommerce Checkout & Funnel Builder By Cartflows

Name of the Vulnerable Software and Affected Versions: WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress versions up to, and including, 1.5.15 Description: The issue is due to missing or incorrect nonce validation on the export json, import json, and status logs file...

PT-2023-11875 · WordPress · Wp Erp

Name of the Vulnerable Software and Affected Versions: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress versions up to, and including, 1.6.3 Description: The issue is due to missing or incorrect nonce validation on the handle leave...

PT-2023-25930 · Pacparser +1 · Pacparser +1

Name of the Vulnerable Software and Affected Versions: Pacparser versions prior to 1.4.2 Description: The issue allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL, which may be realistic within enterprise security products. Recommendations: For...

PT-2023-23911 · Unknown · Wl-Wn531Ax2

Name of the Vulnerable Software and Affected Versions: WL-WN531AX2 versions prior to 2023526 Description: The issue is related to the exposure of resources to the wrong sphere, potentially allowing a network-adjacent attacker to access functions that are originally available only after login,...

PT-2023-4626 · Joplin · Joplin

Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 2.11.5 Description: The issue is related to the lack of protection of the web page structure in the Joplin note-taking application, which can be exploited by a remote attacker to conduct a cross-site scripting XSS...

PT-2023-35890 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 4 crash has been reported. The crash involves the following functions: default get outline, pdfi fapi get glyph, and get fapi...

PT-2023-33031 · Amazon · S2N-Quic

Name of the Vulnerable Software and Affected Versions: s2n-quic version 1.22.0 Description: An issue in s2n-quic results in the endpoint shutting down after receiving an empty UDP packet on a connection. No AWS services are affected, and customers of AWS services do not need to take action...

PT-2023-18712 · Western Digital · My Cloud Os 5

Name of the Vulnerable Software and Affected Versions: My Cloud OS 5 versions prior to 5.26.202 Description: An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack. Recommendations: F...

PT-2023-8458

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.4.12 Description The issue is related to a use-after-free error in the amdgpu cs wait all fences function, located in drivers/gpu/drm/amd/amdgpu/amdgpu cs.c. This error can occur due to a race condition,...

PT-2023-24903 · Unknown · Itsourcecode Online Hotel Management System Project In Php

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Hotel Management System Project In PHP version 1.0.0 Description: The issue allows for Cross Site Scripting XSS and potentially remote code execution by entering malicious code in the date selection box. This can be...

PT-2023-21673

Name of the Vulnerable Software and Affected Versions Rails versions prior to 7.0.5.1 Rails versions prior to 6.1.7.4 Description The redirect to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream...

PT-2023-35505 · Xonotic · Xonotic

Name of the Vulnerable Software and Affected Versions: xonotic versions prior to 0.8.6 Description: A bug was discovered in xonotic that is believed to be exploitable by malicious server admins to crash clients or, if they defeat mitigations, execute arbitrary code. Recommendations: Update to...

PT-2023-25395 · Tuleap · Tuleap

Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 14.9.99.63 Description: The issue occurs when switching from a project visibility that allows restricted users to Private without restricted, where restricted users that are project administrators retain their access...

PT-2023-24261 · Gira Giersiepen · Gira Knx/Ip-Router

Name of the Vulnerable Software and Affected Versions: Gira Giersiepen Gira KNX/IP-Router versions 3.1.3683.0 through 3.3.8.0 Description: The web interface of the affected device allows a remote attacker to read sensitive files via directory-traversal sequences in the URL. This issue enables...

PT-2023-4825 · Libtiff +9 · Libtiff +9

Name of the Vulnerable Software and Affected Versions: libtiff version 4.5.0 Description: The issue is related to a buffer overflow in the rotateImage function of the libtiff library. This overflow can cause a heap-buffer-overflow and SEGV. The vulnerability may allow an attacker to cause a denia...

CVE-2023-3090

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb-cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIGIPVLAN is enabled. We...

CVE-2023-3389 Use after free in io_uring in the Linux Kernel

A use-after-free vulnerability in the Linux Kernel iouring subsystem can be exploited to achieve local privilege escalation. Racing a iouring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59...

CVE-2023-3389 Use after free in io_uring in the Linux Kernel

A use-after-free vulnerability in the Linux Kernel iouring subsystem can be exploited to achieve local privilege escalation. Racing a iouring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59...