PT-2023-7669

Name of the Vulnerable Software and Affected Versions urllib3 versions prior to 1.26.17 urllib3 versions prior to 2.0.5 Description The issue is related to the handling of the Cookie HTTP header in urllib3, a user-friendly HTTP client library for Python. If a user specifies a Cookie header and do...

PT-2023-31754 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.12 through 16.2.8 GitLab EE versions 16.3.0 through 16.3.5 GitLab EE versions 16.4.0 through 16.4.1 Description: An issue has been discovered in Ultimate-licensed GitLab EE that could allow an attacker to impersonate use...

PT-2023-28294 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: A tweet mentions a correction regarding a CVE number, suggesting that the correct identifier should be used. However, no details are provided...

PT-2023-27612 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about a specific vulnerability. It appears to be a rejection notice for a candidate number,...

PT-2023-29256 · Boxy Studio · Boxy Studio Cooked Plugin

Name of the Vulnerable Software and Affected Versions: Boxy Studio Cooked plugin versions = 1.7.13 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher privileges. There is no information...

PT-2023-29162 · WordPress · Wwm Social Share On Image Hover

Name of the Vulnerable Software and Affected Versions: Jobin Jose WWM Social Share On Image Hover plugin versions = 2.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the specifie...

PT-2023-33029 · Cometbft · Cometbft

Name of the Vulnerable Software and Affected Versions: CometBFT versions prior to the next release of each branch Description: A default configuration in CometBFT has been found to be large for common use cases, which may affect block times and consensus participation when fully utilized by chain...

Cisco Releases Security Advisories for Multiple Products

Cisco has released security advisories for vulnerabilities affecting multiple Cisco products. A remote cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following advisories and apply the...

PT-2023-20524 · Ithewei · Libhv

Name of the Vulnerable Software and Affected Versions: ithewei/libhv versions all Description: The issue concerns Cross-site Scripting XSS where filenames containing malicious payloads are not properly sanitized when rendered. This occurs when a file with such a name is served by the application...

PT-2023-29048 · Sscms · Sscms

Name of the Vulnerable Software and Affected Versions: SSCMS version 7.2.2 Description: A cross-site scripting XSS issue was found in the Content Management component. This type of issue allows attackers to inject malicious scripts into content from otherwise trusted websites. Recommendations: Fo...

PT-2023-29016 · Wbce · Wbce

Name of the Vulnerable Software and Affected Versions: WBCE version 1.6.1 Description: A File upload vulnerability allows a local attacker to upload a pdf file with hidden Cross Site Scripting XSS. Recommendations: For WBCE version 1.6.1, consider restricting file uploads to prevent exploitation...

PT-2023-20526 · Unknown · Ithewei/Libhv

Name of the Vulnerable Software and Affected Versions: ithewei/libhv versions all Description: The issue affects the ithewei/libhv package, where untrusted user input used to set request headers can lead to CRLF Injection. An attacker can inject additional headers into the request by adding...

PT-2023-29046 · Sscms · Sscms

Name of the Vulnerable Software and Affected Versions: SSCMS version 7.2.2 Description: A cross-site scripting XSS issue was found in the Column Management component. This type of issue allows attackers to inject malicious scripts into content from otherwise trusted websites. Recommendations: For...

PT-2023-5532 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.02 Description: The issue is related to a buffer overflow in the websGetVar function, which can be exploited to cause a denial of service. This can be achieved by a remote attacker, allowing them to disrupt the...

PT-2023-28664 · Unknown · Asset Management System

Name of the Vulnerable Software and Affected Versions: Asset Management System version 1.0 Description: The issue concerns an unauthenticated SQL Injection vulnerability. It affects the email parameter of the "index.php" page, allowing an external attacker to dump all database contents and bypass...

PT-2023-31172

Name of the Vulnerable Software and Affected Versions Usta AYBS versions prior to 1.0.3 Description The issue is related to an Authorization Bypass Through User-Controlled Key, which allows for Authentication Abuse and Authentication Bypass. It also involves an Improper Neutralization of Special...

PT-2023-20523

Name of the Vulnerable Software and Affected Versions pydash versions prior to 6.0.0 Description The issue affects pydash methods such as pydash.objects.invoke and pydash.collections.invoke map, which accept dotted paths to target nested Python objects. These paths can be used to target internal...

PT-2023-28902 · Github +2 · Github +2

Name of the Vulnerable Software and Affected Versions: matrix-hookshot versions prior to 4.5.0 Description: The issue affects matrix-hookshot, a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances with enabled transformation functions, specifically those...

PT-2023-5611

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.9.23.1 Description The issue is related to an out-of-bounds read within the xrdp executable due to unbounds-checked access to font glyphs in xrdp painter.c. This can result in an out-of-bounds read within a potentially...

Missing slippage control while depositing rewards in SafEth and VotiumStrategy

Lines of code Vulnerability details Summary Deposits to SafEth and VotiumStrategy coming from rewards lack slippage control, making them susceptible to sandwich attacks by MEV bots, which can result in a loss of funds for the protocol. Impact Rewards coming from the VotiumStrategy contract are...