PT-2023-19802 · Riot-Os · Riot-Os

Name of the Vulnerable Software and Affected Versions: RIOT-OS versions prior to 2022.10 Description: The issue affects the network stack of RIOT-OS, an operating system for Internet of Things devices, which can process 6LoWPAN frames. An attacker can send a crafted frame, resulting in a large ou...

PT-2023-19799 · Riot-Os · Riot-Os

Name of the Vulnerable Software and Affected Versions: RIOT-OS versions prior to 2022.10 Description: The issue concerns a network stack in RIOT-OS that processes 6LoWPAN frames. An attacker can send a crafted frame, resulting in a NULL pointer dereference during the forwarding of a fragment. Thi...

PT-2023-22810

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.2 Description The issue allows users to upload attachments to test plans, test cases, etc., without control over the types of files that can be uploaded. A malicious actor may upload an .exe file or a file...

PT-2023-21585 · Avalanche · Avalanche

Name of the Vulnerable Software and Affected Versions: Avalanche versions 6.3.x and below Description: An unrestricted upload of file with a dangerous type vulnerability exists that could allow an attacker to achieve remote code execution. Recommendations: For Avalanche versions 6.3.x and below,...

PT-2023-16134 · WordPress · Weaver Xtreme Theme Support

Name of the Vulnerable Software and Affected Versions: Weaver Xtreme Theme Support WordPress plugin versions prior to 6.2.7 Description: The issue concerns a lack of validation and escaping of certain shortcode attributes, which could allow users with the contributor role and above to perform...

PT-2023-19931 · Apple +2 · Apple Macos +3

Name of the Vulnerable Software and Affected Versions: PowerPanel Business Local/Remote for Windows versions 4.8.6 and earlier PowerPanel Business Management for Windows versions 4.8.6 and earlier PowerPanel Business Local/Remote for Linux 32bit versions 4.8.6 and earlier PowerPanel Business...

PT-2023-22825 · Kiwi Tcms · Kiwitcms/Kiwi +1

Name of the Vulnerable Software and Affected Versions: kiwitcms/Kiwi versions 12.2 and prior kiwitcms/enterprise versions 12.2 and prior Description: The changelog.yml workflow in Kiwi TCMS is vulnerable to command injection attacks due to the use of an untrusted github.head ref field. The...

PT-2023-19220 · Unknown · Davinder Singh Custom Settings Plugin

Name of the Vulnerable Software and Affected Versions: Davinder Singh Custom Settings plugin versions 1.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Davinder Singh Custo...

PT-2023-20071 · Wpchill · Wpchill Cpo Content Types

Name of the Vulnerable Software and Affected Versions: WPChill CPO Content Types plugin versions prior to 1.1.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For WPChill CPO Conte...

PT-2023-14523 · Unknown · 1App Business Forms

Name of the Vulnerable Software and Affected Versions: 1app Business Forms plugin versions prior to 1.0.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication, specifically with author or higher privileges. This vulnerability affects th...

PT-2023-19155 · WordPress · George Gecewicz Portfolio Slideshow

Name of the Vulnerable Software and Affected Versions: George Gecewicz Portfolio Slideshow plugin versions prior to 1.13.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This type of vulnerability allows...

CVE-2023-2241 PoDoFo PdfXRefStreamParserObject.cpp readXRefStreamEntry heap-based overflow

A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObject.cpp. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to th...

PT-2023-18482 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.3.4 Description: The issue involves exposure of private personal information to an unauthorized actor. This occurs in the GitHub repository microweber/microweber. Recommendations: For versions prior t...

CVE-2023-30620

The CVE-2023-30620 issue affects MindsDB where an unsafe extraction using tarfile.extractall() on a remotely retrieved tarball can write extracted files to unintended locations (TarSlip/ZipSlip-like). Affected MindsDB versions allowed remote tarball extraction without path validation, enabling ar...

PT-2023-22464 · H3C · H3C Magic R200

Name of the Vulnerable Software and Affected Versions: H3C Magic R200 version R200V100R004 Description: A stack overflow issue was discovered via the SetMobileAPInfoById interface at the "/goform/aspForm" API endpoint. This issue affects the H3C Magic R200 device. Recommendations: For H3C Magic...

PT-2023-22461 · H3C · H3C Magic R200

Name of the Vulnerable Software and Affected Versions: H3C Magic R200 version R200V100R004 Description: A stack overflow issue was discovered via the UpdateSnat interface at the "/goform/aspForm" API endpoint. This issue affects the H3C Magic R200 device. Recommendations: For H3C Magic R200 versi...

PT-2023-18393 · Modoboa · Modoboa

Name of the Vulnerable Software and Affected Versions: modoboa versions prior to 2.1.0 Description: The issue is related to Cross-Site Request Forgery CSRF in the modoboa repository. An attacker must be logged in as an admin to exploit this issue. Recommendations: For versions prior to 2.1.0,...

PT-2023-18187 · Nunjucks +1 · Nunjucks +1

Name of the Vulnerable Software and Affected Versions: Nunjucks versions prior to 3.2.4 Description: The issue allows bypassing the restrictions provided by the autoescape functionality in Nunjucks. If two user-controlled parameters are on the same line in the views, it is possible to inject...

PT-2023-22813 · WordPress · Form Block

Name of the Vulnerable Software and Affected Versions: Form block versions prior to 1.0.2 Description: The Form block WordPress plugin is subject to a Cross-Site Request Forgery CSRF due to a missing nonce check. This allows requests to be sent to forms from any website without the user's...

PT-2023-12993 · Onos · Onos

Name of the Vulnerable Software and Affected Versions: ONOS version 2.5.1 Description: An issue was discovered in ONOS where there is an incorrect comparison of paths installed by intents. An existing intent does not redirect to a new path, even if a new intent that shares the path with higher...