PT-2023-25015 · Fdkaac +4 · Fdkaac +4

Name of the Vulnerable Software and Affected Versions: fdkaac versions prior to 1.0.5 Description: A heap buffer overflow was discovered in the caf info function in caf reader.c. Recommendations: For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary...

Privilege Escalation

Overview Affected versions of this package are vulnerable to Privilege Escalation. A vulnerability exists in .NET when deserializing a DataSet or DataTable from XML which may result in elevation of privileges. Remediation Upgrade Microsoft.NETCore.App.Runtime.linux-x64 to version 6.0.18, 7.0.7 or...

PT-2023-20714 · Kamyabsoft · Kamyabsoft Chat Bee

Name of the Vulnerable Software and Affected Versions: Kamyabsoft Chat Bee plugin versions prior to 1.1.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Kamyabsoft Chat Bee plugin...

CVE-2015-10118 cchetanonline WP-CopyProtect wp-copyprotect.php CopyProtect_options_page cross site scripting

A vulnerability classified as problematic was found in cchetanonline WP-CopyProtect up to 3.0.0. This vulnerability affects the function CopyProtectoptionspage of the file wp-copyprotect.php. The manipulation of the argument CopyProtectnrctext leads to cross site scripting. The attack can be...

PT-2023-20593 · Hewlett Packard · Hp Device Manager

Name of the Vulnerable Software and Affected Versions: HP Device Manager versions prior to 5.0.10 Description: The issue potentially allows command injection and/or elevation of privileges. Recommendations: For versions prior to 5.0.10, update to version 5.0.10 or later to resolve the issue...

UBUNTU-CVE-2023-1428

There exists an vulnerability causing an abort to be called in gRPC. The following headers cause gRPC's C++ implementation to abort when called via http2: te: x x != trailers :scheme: x x != http, https grpclbclientstats: x x == anything On top of sending one of those headers, a later header must...

PT-2023-3350 · Fortinet · Fortiadcmanager +1

Name of the Vulnerable Software and Affected Versions: FortiADC Manager versions prior to 7.1.0 FortiADC versions 7.0.0 through 7.1.2 FortiADC version 7.2.0 Description: The issue is related to the improper neutralization of special elements used in an operating system command, which can be...

PT-2023-24767 · Tgstation · Tgstation

Name of the Vulnerable Software and Affected Versions: TGstation versions prior to 5.12.5 Description: TGstation is a toolset to manage production BYOND servers. In affected versions, if a Windows user was registered in tgstation-server TGS, an attacker could discover their username by...

CVE-2023-34108 Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords

mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using specially crafted...

PT-2023-22450 · WordPress · Abandoned Cart Lite For Woocommerce

Name of the Vulnerable Software and Affected Versions: Abandoned Cart Lite for WooCommerce plugin for WordPress versions up to, and including, 5.14.2 Description: The issue is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This...

Important: byacc

Issue Overview: When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory use after free. CVE-2021-33641 When a file is processed, an infinite loop occurs in nextinline of the morecurly function. CVE-2021-33642...

avo possible unsafe reflection / partial DoS vulnerability

Summary The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. Details After reviewing th...

PT-2023-24597 · Notation · Notation

Name of the Vulnerable Software and Affected Versions: notation versions prior to v1.0.0-rc.6 Description: The issue allows an attacker who has compromised a registry and added a high number of signatures to an artifact to cause denial of service of services on the machine, if a user runs the...

Security Bulletin: Vulnerability in spring-expressions may affect IBM Business Automation Workflow - CVE-2023-20863

Summary IBM Business Automation Workflow packages a vulnerable copy of spring-expressions in BPM/Lombardi/lib. Vulnerability Details CVEID:CVE-2023-20863 DESCRIPTION: VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper input validation. By sending a specially...

PT-2023-16041 · WordPress · Wp Multi Store Locator

Name of the Vulnerable Software and Affected Versions: WP Multi Store Locator WordPress plugin versions prior to 2.5 Description: The issue concerns the WP Multi Store Locator WordPress plugin, which does not properly validate and escape certain shortcode attributes. This could allow users with t...

PT-2023-19438 · Vcita · Online Booking & Scheduling Calendar For Wordpress

Name of the Vulnerable Software and Affected Versions: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress versions up to, and including, 4.2.10 Description: The issue is related to a missing capability check on the vcita logout callback function, allowing...

PT-2023-18812 · Vcita · Online Booking & Scheduling Calendar For Wordpress

Name of the Vulnerable Software and Affected Versions: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress versions up to, and including, 4.2.10 Description: The issue allows unauthorized modification of data via the "/wp-json/vcita-wordpress/v1/actions/auth"...

PT-2023-18809 · Vcita · Online Booking & Scheduling Calendar For Wordpress

Name of the Vulnerable Software and Affected Versions: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress versions up to, and including, 4.2.10 Description: The issue is related to Stored Cross-Site Scripting via the business id parameter due to insufficient inpu...

Unspent WETH is not considered in buyNftFromMarket()

Lines of code Vulnerability details Unspent WETH is not considered in buyNftFromMarket Impact In the buyNftFromMarket function, the borrower buys an NFT in order to repay and close their loan. The purchase is executed in the internal function named execBuyNftFromMarket. 395: function...

PT-2023-32972 · Unknown · Pocketmine-Mp

Name of the Vulnerable Software and Affected Versions: PocketMine-MP versions prior to 4.18.0-ALPHA2 Description: The issue arises from the client sending a "mismatch" type InventoryTransactionPacket to request a resync of all currently open inventories. Since PocketMine-MP does not rate-limit...