PT-2023-32099 · WordPress · Jquery News Ticker Plugin

Name of the Vulnerable Software and Affected Versions: Jquery news ticker plugin for WordPress versions up to, and including, 3.0 Description: The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the plugin's...

PT-2025-26465 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.0 through 16.3.5 GitLab EE versions 16.4 through 16.4.1 GitLab EE versions 16.5 through 16.5.0 Description: An issue has been discovered in GitLab EE where arbitrary access to the titles of private specific references...

PT-2023-32027 · WordPress · Photos/Files Contest Gallery Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Photos and Files Contest Gallery WordPress plugin version 21.2.8.1 and earlier Description: The issue allows unauthenticated users to perform Cross-Site Scripting attacks via certain headers due to the plugin not sanitising and escaping some...

PT-2023-27935 · Calico · Calico Enterprise Typha +1

Name of the Vulnerable Software and Affected Versions: Calico Typha versions 3.26.2 and below Calico Enterprise Typha versions 3.17.1, 3.16.3, 3.15.3 and below Description: In certain conditions, a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service...

PT-2023-32398 · Pkp · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - Reflected, which occurs when an application includes user input in its responses without properly validating or encoding the input, allowin...

PT-2023-25740 · Sap · Sap Enable Now

Name of the Vulnerable Software and Affected Versions: SAP Enable Now versions WPB MANAGER 1.0, WPB MANAGER CE 10, WPB MANAGER HANA 10, ENABLE NOW CONSUMP DEL 1704 Description: The issue is related to the absence of the X-FRAME-OPTIONS response header in SAP Enable Now, allowing an unauthenticate...

PT-2023-18130 · Unknown · Package Manager Service

Name of the Vulnerable Software and Affected Versions: Package Manager Service affected versions not specified Description: The issue is related to side channel information disclosure in the Package Manager Service, allowing an attacker to determine whether an app is installed without query...

PT-2023-29696 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The issue was reported via the National Vulnerability Database. No further details are provided about the nature of the issue or its potential...

PT-2023-28990 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.6.12 BigBlueButton versions prior to 2.7.0-rc.1 Description: The issue is related to Server-Side Request Forgery SSRF, which is a bypass of a previously known problem. A patch was applied to disable follow...

PT-2023-6766 · Lenovo · Lenovo Printers

Name of the Vulnerable Software and Affected Versions: Lenovo printers affected versions not specified Description: A remote code execution issue was found in the firmware used in some Lenovo printers. This can be caused by a remote user sending an illegal string to the server-side interface via ...

PT-2023-6605

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.15.16 Apache ActiveMQ versions 5.16.x through 5.16.6 Apache ActiveMQ versions 5.17.x through 5.17.5 Apache ActiveMQ versions 5.18.x through 5.18.2 Bamboo Data Center affected versions not specified Bamboo...

PT-2023-29258 · Unknown · Leave Management System Project

Name of the Vulnerable Software and Affected Versions: Leave Management System Project version 1.0 Description: The issue concerns multiple Authenticated SQL Injection vulnerabilities. Specifically, the setcasualleave parameter of the "admin/setleaves.php" resource does not validate the character...

PT-2023-29909 · Brainstorm Force · Ultimate Addons For Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: Brainstorm Force Ultimate Addons for WPBakery Page Builder plugin versions = 3.19.14 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher permissions. There is no...

PT-2023-13455 · Lenovo · Lenovo App Store

Name of the Vulnerable Software and Affected Versions: Lenovo App Store affected versions not specified Description: An information disclosure issue has been identified in the Lenovo App Store, which may allow some applications to gain unauthorized access to sensitive user data used by other...

PT-2023-29180 · Unknown · Online Art Gallery

Name of the Vulnerable Software and Affected Versions: Online Art Gallery version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. The lnm parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the...

PT-2023-29828 · WordPress · Rednao Woocommerce Pdf Invoice Builder

Name of the Vulnerable Software and Affected Versions: RedNao WooCommerce PDF Invoice Builder plugin versions 1.2.102 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website,...

PT-2023-30031 · Unknown · Best Courier Management System

Name of the Vulnerable Software and Affected Versions: Best Courier Management System version 1.0 Description: The issue concerns a Cross Site Scripting XSS vulnerability in the change username field. This allows for potential malicious script injection, affecting the security of the system...

Mozilla Releases Security Advisories for Multiple Products

Mozilla has released security updates to address vulnerabilities in Firefox and Thunderbird. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Mozilla advisories for more...

PT-2023-29462 · Google · Android Client

Name of the Vulnerable Software and Affected Versions: Android Client affected versions not specified Description: The Android Client application uses the HTTP protocol to retrieve sensitive information, including IP addresses and credentials to connect to a remote MQTT broker entity, instead of...

PT-2023-29431 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 12.0-rc-1 through 12.10.11 XWiki Platform versions 15.5-rc-1 and prior Description: The XWiki Platform is vulnerable to a reflected cross-site scripting attack in the page creation form when document names are validate...