Mozilla Releases Security Advisories for Multiple Products

Mozilla has released security updates to address vulnerabilities in Firefox and Thunderbird. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Mozilla advisories for more...

PT-2023-29431

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 12.0-rc-1 through 12.10.11 XWiki Platform versions 15.5-rc-1 and prior Description The XWiki Platform is vulnerable to a reflected cross-site scripting attack in the page creation form when document names are validated...

PT-2023-29462 · Google · Android Client

Name of the Vulnerable Software and Affected Versions: Android Client affected versions not specified Description: The Android Client application uses the HTTP protocol to retrieve sensitive information, including IP addresses and credentials to connect to a remote MQTT broker entity, instead of...

PT-2023-29902 · WordPress · Jeff Sherk Auto Login New User After Registration

Name of the Vulnerable Software and Affected Versions: Jeff Sherk Auto Login New User After Registration plugin versions = 1.9.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-29683 · Fastwpspeed · Fast Wp Speed

Name of the Vulnerable Software and Affected Versions: Fastwpspeed Fast WP Speed plugin version 1.0.0 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into websites, potentially leading to unauthoriz...

PT-2023-22498 · Unknown · Pfsense Ce

Name of the Vulnerable Software and Affected Versions: Pfsense CE version 2.6.0 Description: The issue is related to the absence of a rate limit, which can be exploited by an attacker to create multiple malicious users in the firewall. This can lead to potential security breaches. Recommendations...

PT-2023-28806 · Unknown · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMSmadesimple version 2.2.18 Description: A Cross Site Scripting issue allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parameter in the File Picker Menu component. This enables the attacker to injec...

PT-2023-29292 · Unknown · Zenario Cms

Name of the Vulnerable Software and Affected Versions: Zenario CMS version 9.4.59197 Description: A Cross-Site Scripting XSS issue allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias. This enables the attacker to potentially perform unauthorized...

PT-2023-32951 · Php · Php

Name of the Vulnerable Software and Affected Versions: Base64 Encoder/Decoder WordPress plugin versions 0.9.2 and earlier PHP versions prior to 8.0.30 PHP versions prior to 8.1.22 PHP versions prior to 8.2.8 Description: The issue concerns a lack of CSRF check in the Base64 Encoder/Decoder...

PT-2023-12108 · Zscaler · Zscaler Client Connector

Name of the Vulnerable Software and Affected Versions: Zscaler Client Connector Installer and Uninstallers for Windows versions prior to 3.6 Description: The issue is related to an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges...

PT-2023-26330 · Unknown · Superwebmailer

Name of the Vulnerable Software and Affected Versions: SuperWebMailer version 9.00.0.01710 Description: An issue was discovered that allows for XSS via a GET parameter in the keepalive.php file. Recommendations: For SuperWebMailer version 9.00.0.01710, consider restricting access to the...

PT-2023-29813 · Wbce Cms · Wbce Cms

Name of the Vulnerable Software and Affected Versions: WBCE CMS versions 1.6.1 and earlier Description: A Cross Site Scripting XSS issue allows a remote attacker to escalate privileges via a crafted script to the website footer parameter in the "admin/settings/save.php" component. Recommendations...

PT-2023-7181 · Ibm · Ibm Cognos Dashboards On Cloud Pak For Data

Name of the Vulnerable Software and Affected Versions: IBM Cognos Dashboards on Cloud Pak for Data version 4.7.0 Description: The issue is caused by a reverse tabnabbing flaw, which could allow a remote attacker to bypass security restrictions. An attacker could exploit this and redirect a victim...

PT-2023-14159 · WordPress · Cyr To Lat Plugin

Name of the Vulnerable Software and Affected Versions: Cyr to Lat plugin for WordPress versions up to, and including, 3.5 Cyr to Lat plugin for WordPress version 3.6 Description: The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the ctl sanitize title function d...

PT-2023-12753 · WordPress · Imagemagick Engine

Name of the Vulnerable Software and Affected Versions: ImageMagick Engine plugin for WordPress versions up to, and including 1.7.5 Description: The issue allows for remote code execution via the cli path parameter. This enables unauthenticated users to run arbitrary commands, potentially leading ...

PT-2023-14066

Name of the Vulnerable Software and Affected Versions TinyLab linux-lab version 1.1-rc1 TinyLab cloud-lab version 0.8-rc2 Description The default configuration of TinyLab linux-lab and cloud-lab could cause Container Escape due to insecure permissions. Recommendations For TinyLab linux-lab versio...

PT-2023-20277 · Apache · Apache Shenyu

Name of the Vulnerable Software and Affected Versions: Apache ShenYu version 2.5.1 Description: There exists an SSRF Server-Side Request Forgery vulnerability located at the "/sandbox/proxyGateway" endpoint. This vulnerability allows manipulation of arbitrary requests and retrieval of correspondi...

PT-2023-29938 · Roundcube · Roundcube

Name of the Vulnerable Software and Affected Versions: Roundcube versions 1.4.x through 1.4.14 Roundcube versions 1.5.x through 1.5.4 Roundcube versions 1.6.x through 1.6.3 Description: The issue allows for XSS via a text/html e-mail message containing an SVG image with a USE element. This is...

PT-2023-31205 · WordPress · Bear

Name of the Vulnerable Software and Affected Versions: The BEAR for WordPress versions up to, and including, 1.1.3.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the woobe bulkoperations swap function. This allows unauthenticated...

PT-2025-23031 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 137.0.7151.55 Description: The issue is related to an inappropriate implementation in the Tab Strip of Google Chrome, allowing a remote attacker to perform UI spoofing via a crafted HTML page. The severity of...