PT-2023-33066 · Birdcage · Birdcage

Name of the Vulnerable Software and Affected Versions: birdcage affected versions not specified Description: The issue allows environment variables to be read from procfs unless a new process is started. This can be demonstrated through a proof of concept that shows how a secret environment...

Okta Discloses Broader Impact Linked to October 2023 Support System Breach

Identity services provider Okta has disclosed that it detected "additional threat actor activity" in connection with the October 2023 breach of its support case management system. "The threat actor downloaded the names and email addresses of all Okta customer support system users," the company sa...

MAL-2023-8630 Malicious code in @lognex/ecom-recommendations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0ab65eb1c1e53ad84ab09e9426d718197e6137500c81a66639f4e4249e39edb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-7936

Name of the Vulnerable Software and Affected Versions logback version 1.4.11 Confluence Data Center and Server versions from 6.0.1 to 8.7.1 Confluence Data Center and Server versions from 8.7.0 to 8.7.1 Confluence Data Center versions from 8.6.0 to 8.6.2 Confluence Data Center versions from 8.5.0...

PT-2023-31049 · Unknown +3 · Carrierwave +3

Name of the Vulnerable Software and Affected Versions: CarrierWave versions prior to 2.2.5 CarrierWave versions prior to 3.0.5 Description: The issue is related to a Content-Type allowlist bypass vulnerability in CarrierWave, which could lead to XSS attacks. The allowlisted content type? function...

WordPress Widgets for Reviews & Recommendations Plugin <= 11.0.2 is vulnerable to Arbitrary File Upload

Software Widgets for Reviews & Recommendations Type Plugin Vulnerable versions = 11.0.2 Fixed in 11.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-48275 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID 8fc9ea713278 Credits Rafie Muhammad...

PT-2023-14012

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.16.6 Apache ActiveMQ versions prior to 5.17.4 Apache ActiveMQ versions prior to 5.18.0 Apache ActiveMQ versions prior to 6.0.0 Description An authentication flaw in the Jolokia component allows an...

PT-2023-29970 · Prestashop · Product Catalog (Csv

Name of the Vulnerable Software and Affected Versions: PrestaShop module "Product Catalog CSV, Excel Export/Update" versions prior to 3.8.5 Description: The issue allows a guest to perform SQL injection due to sensitive SQL calls in the productsUpdateModel::getExportIds method. This can be...

PT-2023-31037 · Tenda · Tenda Ax1803

Name of the Vulnerable Software and Affected Versions: Tenda AX1803 version 1.0.0.1 Description: The issue allows a remote attacker to execute arbitrary code via the ssid parameter in the form fast setting wifi set function. This enables the attacker to potentially gain control over the device...

PT-2023-8334 · Yealink · Yealink Meeting Server

Name of the Vulnerable Software and Affected Versions: Yealink Meeting Server affected versions not specified Description: The issue exists due to the failure to neutralize special elements used in an operating system command. This could allow a remote attacker to execute arbitrary commands with...

PT-2023-7270 · Rvtools · Rvtools

Name of the Vulnerable Software and Affected Versions: RVTools versions 3.9.2 and above Description: The issue is related to errors in cryptographic transformations, which can allow a remote attacker to gain unauthorized access to protected information. Specifically, the vulnerability in the...

PT-2023-8644

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 3.2 excluding FIPS modules in 3.2, 3.1, and 3.0 Description The issue arises from the improper handling of NULL fields in PKCS12 files, leading to a potential Denial of Service attack. Applications loading files in th...

PT-2023-32471 · WordPress · Userpro

Name of the Vulnerable Software and Affected Versions: UserPro plugin for WordPress versions up to, and including, 5.1.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on multiple functions. This allows unauthenticated attackers to add...

PT-2023-32084 · WordPress · Funnelforms Free

Name of the Vulnerable Software and Affected Versions: Funnelforms Free plugin for WordPress versions up to and including 3.4 Description: The issue allows authenticated attackers with subscriber-level permissions and above to modify data without proper authorization. This is due to a missing...

PT-2023-30411 · Headwind · Headwind Mdm Web Panel

Name of the Vulnerable Software and Affected Versions: Headwind MDM Web panel version 5.22.1 Description: The issue allows attackers to upload arbitrary files, including HTML files, to the server. When a victim downloads and opens one of these files, their browser renders the content as a web pag...

Code injection

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are...

PYSEC-2023-288

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are...

CISA, FBI, MS-ISAC, and ASD’s ACSC Release Advisory on LockBit Affiliates Exploiting Citrix Bleed

Today, the Cybersecurity and Infrastructure Security Agency CISA, Federal Bureau of Investigation FBI, Multi-State Information Sharing & Analysis Center MS-ISAC, and Australian Signals Directorate’s Australian Cyber Security Center ASD’s ACSC released a joint Cybersecurity Advisory CSA,...

PT-2023-18554 · Oracle +1 · Java +2

Name of the Vulnerable Software and Affected Versions: Bamboo Data Center and Server versions 8.1.0 through 9.3.0 Description: This issue allows an authenticated attacker to execute arbitrary code, which has high impact to confidentiality, integrity, and availability, and requires no user...

PT-2023-8883 · Nextcloud +2 · Nextcloud Server +3

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 25.0.0 through 25.0.10 Nextcloud Server versions 26.0.0 through 26.0.5 Nextcloud Server versions 27.0.0 through 27.0.0 Nextcloud Enterprise Server versions 22.0.0 through 22.2.10.15 Nextcloud Enterprise Server versio...