PT-2023-21879 · Unknown · Conprosys Hmi System

Name of the Vulnerable Software and Affected Versions: CONPROSYS HMI System CHS versions prior to 3.5.3 Description: An issue exists due to improper access control, allowing a user of the PC where the affected product is installed to potentially gain administrative privileges. This could result i...

PT-2023-23383 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.5.3 Description: A stored Cross-site scripting XSS vulnerability in the FundRaiserEditor.php component allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For ChurchCRM version...

PT-2023-24752 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2023.05 Description: The issue concerns a specific endpoint that was vulnerable to brute force attacks. Recommendations: For versions prior to 2023.05, update to version 2023.05 or later to resolve the iss...

CVE-2023-33183 Error in calendar when booking an appointment reveals the full path of the website

Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server is unavailable. It is recommended that the Calendar app is updated to 3.5.5 or 4.2.3...

CVE-2023-33182 Nextcloud Contacts photos only sanitized if mime type is all lower case

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob in memory data that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It i...

Rage quit modifications should be limited to provide stronger guarantees to party members

Lines of code Vulnerability details Rage quit modifications should be limited to provide stronger guarantees to party members Party hosts can arbitrarily change the rage quit settings overriding any existing preset. Impact Rage quit is implemented in the PartyGovernanceNFT contract by using a...

PT-2023-19703 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev24 Description: The issue allows for XSS via a non-app deeplink, such as the jslob API's registry sub-tree. Recommendations: For versions prior to 7.10.6-rev24, update to version 7.10.6-rev24 or later ...

PT-2023-19704 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev24 Description: The issue allows for XSS via data to the Tumblr portal widget, such as a post title. Recommendations: For versions prior to 7.10.6-rev24, update to version 7.10.6-rev24 or later to...

PT-2023-24290 · WordPress · Woocommerce Follow-Up Emails

Name of the Vulnerable Software and Affected Versions: WooCommerce Follow-Up Emails AutomateWoo plugin versions prior to 4.9.41 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts...

PT-2023-24282 · WordPress · Crm Perks Contact Form Entries

Name of the Vulnerable Software and Affected Versions: CRM Perks Contact Form Entries plugin versions prior to 1.3.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This type of vulnerability allows an...

PT-2023-13479 · Unknown · Metagauss Download Plugin

Name of the Vulnerable Software and Affected Versions: Metagauss Download Plugin versions = 2.0.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-24226 · WordPress · Woodiscuz – Woocommerce Comments

Name of the Vulnerable Software and Affected Versions: WooDiscuz – WooCommerce Comments versions through 2.2.9 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows Stored XSS and affects the WooDiscuz – WooCommerce Comments plugin. It...

CVE-2023-33184

Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3...

Server side request forgery (ssrf)

Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3...

CVE-2023-33247

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog serv...

CVE-2023-32323 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

PT-2023-20088 · Anton Skorobogatov · Rus-To-Lat Plugin

Name of the Vulnerable Software and Affected Versions: Anton Skorobogatov Rus-To-Lat plugin versions 0.3 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actio...

PT-2023-24104 · WordPress · Better Notifications For Wp

Name of the Vulnerable Software and Affected Versions: Made with Fuel Better Notifications for WP plugin versions 1.9.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-19154 · Uncanny Owl · Uncanny Toolkit For Learndash

Name of the Vulnerable Software and Affected Versions: Uncanny Owl Uncanny Toolkit for LearnDash plugin versions = 3.6.4.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-15107 · Nagvis +1 · Nagvis +1

Name of the Vulnerable Software and Affected Versions: Nagvis versions prior to 1.9.34 Description: The issue is related to an arbitrary file read vulnerability. It affects the component /core/classes/NagVisHoverUrl.php. Recommendations: For versions prior to 1.9.34, update to version 1.9.34 or...