PT-2023-22261 · WordPress · Steven A. Zahm Connections Business Directory

Name of the Vulnerable Software and Affected Versions: Steven A. Zahm Connections Business Directory plugin versions = 10.4.36 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. Recommendations: For Steve...

PT-2023-22065 · WordPress · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce plugin versions = 2.1.48 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability in the PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, and...

PT-2023-22141 · Pi Websolution · Pi Websolution Conditional Cart Fee Plugin

Name of the Vulnerable Software and Affected Versions: PI Websolution Conditional cart fee plugin versions 1.0.96 and earlier Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations: For PI Websoluti...

PT-2023-13738 · Tenda · Tenda Ac6 Ac1200 Smart Dual-Band Wifi Router

Name of the Vulnerable Software and Affected Versions: Tenda AC6 AC1200 Smart Dual-Band WiFi Router version 15.03.06.50 multi Description: A cross-site scripting XSS issue was found in the Parental Control module, specifically via the deviceId parameter. This allows for potential malicious script...

PT-2023-23166 · Lenovo · Lxca

Name of the Vulnerable Software and Affected Versions: LXCA affected versions not specified Description: An unauthenticated XML external entity injection XXE vulnerability exists in LXCA's Common Information Model CIM server that could result in read-only access to specific files. Recommendations...

PT-2023-25054 · H3C · H3C Magic B1St

Name of the Vulnerable Software and Affected Versions: H3C Magic B1STW version B1STV100R012 Description: The issue is related to a stack overflow via the function SetAPInfoById, allowing attackers to cause a Denial of Service DoS via a crafted POST request. Recommendations: For version...

PT-2023-25668 · Inex · Ixpmanager

Name of the Vulnerable Software and Affected Versions: INEX IXP-Manager versions prior to 6.3.1 Description: The issue allows for XSS attacks. The following files may be affected: list-preamble.foil.php, page-header-preamble.foil.php, edit-form.foil.php, overview.foil.php, cust.foil.php, and...

PT-2023-25634 · Basecamp · Com.Basecamp.Bc3

Name of the Vulnerable Software and Affected Versions: com.basecamp.bc3 versions prior to 4.2.1 Description: Directory traversal can occur in the com.basecamp.bc3 application, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a...

PT-2023-25021 · Microworld Technologies · Escan Management Console

Name of the Vulnerable Software and Affected Versions: Microworld Technologies eScan Management console version 14.0.1400.2281 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary JavaScript code via a vulnerable delete file parameter. This enables the attacker ...

Lack of deep validation

Lines of code Vulnerability details Impact The validate functions are just checking the parameters type without checking any further information Proof of Concept They are just trying to cast the value with i.TYPE and check if there is an error. There is no further validations e. g...

PT-2023-22653 · Libcoap +1 · Libcoap +1

Name of the Vulnerable Software and Affected Versions: libcoap library versions 4.3.1-103-g52cfd56 through 4.3.1-119 Description: The issue is related to a Buffer Overflow vulnerability in the coap send function. This vulnerability allows attackers to obtain sensitive information via a malformed...

PT-2023-21554 · Pegasystems · Pega Platform

Name of the Vulnerable Software and Affected Versions: Pega platform versions 7.4 through 8.8.x Description: The issue affects Pega platform clients who have upgraded from a version prior to 8.x and are using versions 7.4 through 8.8.x, potentially utilizing default credentials. Recommendations:...

PT-2023-24708 · WordPress · Wp Overnight Quick/Bulk Order Form For Woocommerce

Name of the Vulnerable Software and Affected Versions: WP Overnight Quick/Bulk Order Form for WooCommerce plugin versions = 3.5.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For WP...

PT-2023-21602 · Unknown · Aakif Kadiwala Tags Cloud Manager

Name of the Vulnerable Software and Affected Versions: Aakif Kadiwala Tags Cloud Manager plugin versions 1.0.0 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

PT-2023-22460 · Fortra · Fortra Globalscape Eft

Name of the Vulnerable Software and Affected Versions: Fortra Globalscape EFT versions prior to 8.1.0.16 Description: The issue is related to a denial of service, where a compressed message that decompresses to itself can cause infinite recursion, leading to a service crash. Recommendations: For...

PT-2023-21610 · Rocket · Rocket

Name of the Vulnerable Software and Affected Versions: eRocket plugin versions prior to 1.2.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 1.2.5, update to...

PT-2023-4737 · WordPress · Wp Quick Post Duplicator

Name of the Vulnerable Software and Affected Versions: Quick Post Duplicator for WordPress versions up to, and including, 2.0 Description: The issue is related to SQL Injection via the post id parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation...

PT-2023-15417 · WordPress · Rapidload Power-Up For Autoptimize

Name of the Vulnerable Software and Affected Versions: RapidLoad Power-Up for Autoptimize plugin versions = 1.6.35 Description: The issue is related to an SQL Injection vulnerability in the RapidLoad Power-Up for Autoptimize plugin. This vulnerability can be exploited by authenticated subscribers...

PT-2023-21759 · WordPress · Smtp2Go – Email Made Easy

Name of the Vulnerable Software and Affected Versions: SMTP2GO – Email Made Easy plugin versions = 1.4.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For SMTP2GO – Email Made Easy plugin...

PT-2023-24293 · Repute Infosystems · Armember

Name of the Vulnerable Software and Affected Versions: Repute InfoSystems ARMember plugin versions prior to 4.0.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to 4.0.3,...