PT-2023-12274 · Unknown · Mobicint Backend For Credit Unions

Name of the Vulnerable Software and Affected Versions: Mobicint Backend for Credit Unions version 3 Description: An issue in the software allows attackers to retrieve partial email addresses and user-entered information via submission to the "forgotten-password endpoint". Recommendations: For...

PT-2023-21732 · Pretalx · Pretalx

Name of the Vulnerable Software and Affected Versions: pretalx versions 2.3.1 through 2.3.1 Description: The issue allows path traversal in HTML export, a non-default feature. Users can upload crafted HTML documents that trigger the reading of arbitrary files. Recommendations: For pretalx version...

PT-2023-20947 · Teacms · Teacms

Name of the Vulnerable Software and Affected Versions: TeaCMS affected versions not specified Description: A Cross Site Scripting issue in TeaCMS storage allows an attacker to cause a leak of sensitive information via the article title parameter. This enables the attacker to potentially access or...

PT-2023-9256

Name of the Vulnerable Software and Affected Versions Gogs versions 0.13.0 and earlier Description The built-in SSH server of Gogs allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending ...

PT-2023-2483 · Inea · Inea Me Rtu

Name of the Vulnerable Software and Affected Versions: INEA ME RTU versions prior to 3.36 Description: The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This could allow a remote attacker to execute arbitrary code. The estimated numb...

PT-2023-21731 · Pretalx · Pretalx

Name of the Vulnerable Software and Affected Versions: pretalx versions 2.3.1 through 2.3.1 Description: The issue allows path traversal in HTML export, a non-default feature. Organizers can trigger the overwriting of an arbitrary file with the standard pretalx 404 page content. Recommendations:...

PT-2023-22808 · Discourse · Discourse-Reactions

Name of the Vulnerable Software and Affected Versions: Discourse-reactions versions prior to 0.3 Description: The Discourse-reactions plugin for the Discourse messaging platform has an issue where data about reactions performed on a post in a private topic could be leaked. This affects the...

PT-2023-17895 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-12 through Android-13 Description: In the inflate function of inflate.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional...

PT-2023-17882 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-11 through Android-13 Description: A local escalation of privilege issue exists due to a possible way to keep the foreground service alive while the app is in the background. This could lead to local escalation of...

PT-2023-17887 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-11 through Android-13 Description: A path traversal error in the extractRelativePath function of FileUtils.java allows access to files in a directory belonging to other applications. This issue could lead to local...

PT-2023-2496 · Mysql Server +7 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.32 and prior Description: The issue is related to insufficient input validation in the Server: Optimizer component of MySQL Server, allowing a high-privileged attacker with network access via multiple protocols to...

PT-2023-17988 · WordPress · Thumbnail Carousel Slider

Name of the Vulnerable Software and Affected Versions: Thumbnail carousel slider plugin for WordPress versions up to, and including, 1.1.9 Description: The issue is related to Reflected Cross-Site Scripting via the search term parameter due to insufficient input sanitization and output escaping...

PT-2023-21962

Name of the Vulnerable Software and Affected Versions ExpressTech Quiz And Survey Master versions through 8.1.4 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by...

PT-2023-18155 · Nuxtlabs · Nuxtlabs/Github-Module

Name of the Vulnerable Software and Affected Versions: nuxtlabs/github-module versions prior to 1.6.2 Description: The issue involves the use of hard-coded credentials in the GitHub repository nuxtlabs/github-module. A hardcoded GitHub token was found in the source code, which had access to...

PT-2023-21592 · Qualys +1 · Qualys Cloud Agent +1

Name of the Vulnerable Software and Affected Versions: Qualys Cloud Agent for macOS versions 2.5.1-75 through 3.7 Description: The Qualys Cloud Agent for macOS installer allows a local escalation of privilege, bounded only to the time of installation and only on older macOSX versions macOS 10.15...

PT-2023-16217 · Wpbakery · Pricing Tables For Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: Pricing Tables For WPBakery Page Builder versions prior to 3.0 Description: The issue arises from the plugin's failure to validate and escape certain shortcode attributes before outputting them in a page or post, potentially allowing users wi...

PT-2023-21310 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.106 Description: A SQL injection issue was found in DedeCMS via the component /dede/sys sql query.php. This allows for potential exploitation. Recommendations: For DedeCMS version 5.7.106, update to a version that fixes th...

PT-2023-22767 · Nextcloud · Nextcloud Talk

Name of the Vulnerable Software and Affected Versions: Nextcloud Talk versions prior to 15.0.5 Description: The issue allows a user added later to a conversation to access data that was deleted before they were added. This is a problem in Nextcloud Talk, a chat, video, and audio call extension fo...

PT-2023-16853 · Wpbakery · Pricing Tables For Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: Pricing Tables For WPBakery Page Builder formerly Visual Composer versions prior to 3.0 Description: The issue allows any authenticated users, such as subscribers, to perform Local File Inclusion LFI attacks due to the lack of validation of...

PT-2023-16592 · WordPress · Themeflection Numbers

Name of the Vulnerable Software and Affected Versions: Themeflection Numbers WordPress plugin versions prior to 2.0.1 Description: The issue is related to a lack of authorisation and CSRF check in an AJAX action, which does not ensure that the options to be updated belong to the plugin. This coul...