PT-2023-6173

Name of the Vulnerable Software and Affected Versions Sangfor Next-Gen Application Firewall version NGAF8.0.17 Description The issue is related to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP PO...

PT-2023-6080 · Siemens · Simatic Cp 1628 +4

Name of the Vulnerable Software and Affected Versions: SIMATIC CP 1604 versions all SIMATIC CP 1616 versions all SIMATIC CP 1623 versions all SIMATIC CP 1626 versions all SIMATIC CP 1628 versions all Description: The issue is related to insufficient control of access to memory DMA, which could...

PT-2023-6152 · Microsoft · Directmusic +1

Name of the Vulnerable Software and Affected Versions: Microsoft DirectMusic affected versions not specified Description: The issue is related to insufficient input validation in the DirectMusic component of Windows operating systems. This can be exploited by remote attackers to execute arbitrary...

PT-2023-6004 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 7.0.0 through 7.0.12 Fortinet FortiOS versions 7.2.0 through 7.2.5 Fortinet FortiOS version 7.4.0 Description: The issue is related to the use of the GET request method with sensitive query strings in Fortinet FortiO...

PT-2023-28578 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP affected versions not specified Description: The issue occurs when a non-admin user is assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration...

PT-2023-6007 · Fortinet · Fortimanager

Name of the Vulnerable Software and Affected Versions: FortiManager versions 6.0 through 7.2.2 Description: The issue is related to improper access control in the FortiManager management interface. This can allow a remote and authenticated attacker with at least "device management" permission on...

PT-2023-6329

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.0-M11 Apache Tomcat versions 10.1.0-M1 through 10.1.13 Apache Tomcat versions 9.0.0-M1 through 9.0.81 Apache Tomcat versions 8.5.0 through 8.5.93 Description The issue is related to improper input...

PT-2023-6409 · Fortinet · Fortimanager +1

Name of the Vulnerable Software and Affected Versions: FortiAnalyzer versions 7.2.0 through 7.2.3 and before 7.0.8 FortiAnalyzer version 7.4.0 FortiManager versions 7.2.0 through 7.2.3 and before 7.0.8 FortiManager version 7.4.0 Description: A server-side request forgery issue allows a remote...

PT-2024-13254 · Fortinet · Forticlientmac

Name of the Vulnerable Software and Affected Versions: FortiClientMac versions 7.2.3 and below FortiClientMac version 7.0.10 and below installer Description: The issue allows a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting...

PT-2023-13453 · Unknown · Orocommerce

Name of the Vulnerable Software and Affected Versions: OroCommerce versions 4.1.0 through 4.1.13 OroCommerce versions 4.2.0 through 4.2.10 OroCommerce versions 5.0.0 through 5.0.10 OroCommerce versions 5.1.0 Description: The issue allows a JS payload added to the product name to be executed at th...

PT-2023-36059 · Git +1 · Radare2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions: r str ncpy, Elf64 load symbols from, and Elf64 load...

PT-2023-27204 · WordPress · Gangesh Matta Simple Org Chart

Name of the Vulnerable Software and Affected Versions: Gangesh Matta Simple Org Chart plugin versions prior to 2.3.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actio...

PT-2023-29282 · Unknown · Gdidees Cms

Name of the Vulnerable Software and Affected Versions: GDidees CMS version 3.0 Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title. This enables attackers to inject malicious scripts into the...

Cisco Releases Security Advisories for Multiple Products

Cisco released security advisories for vulnerabilities affecting multiple Cisco products. A remote cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following advisories and apply the necessa...

PT-2023-5764 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G version A1V1.0.2B05 Description: The issue is related to a buffer overflow in the SetWLanRadioSecurity function via the Encryption parameter. This allows attackers to cause a Denial of Service DoS via a crafted input. The...

PT-2023-29441 · 1E · 1E Client

Name of the Vulnerable Software and Affected Versions: 1E Client versions 8.1 through 9.0 Description: The 1E Client installer can perform arbitrary file deletion on protected files. A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the...

CISA and NSA Release New Guidance on Identity and Access Management

Today, CISA and the National Security Agency NSA published Identity and Access Management: Developer and Vendor Challenges, authored by the Enduring Security Framework ESF, a CISA- and NSA-led working panel that includes a public-private cross-sector partnership. ESF aims to address risks that...

PT-2023-20107 · Unknown · Jeff Sherk Update Theme/Plugins From Zip File

Name of the Vulnerable Software and Affected Versions: Jeff Sherk Update Theme and Plugins from Zip File plugin versions = 2.0.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web applicati...

PT-2023-6558

Name of the Vulnerable Software and Affected Versions Django versions 3.2 before 3.2.22 Django versions 4.1 before 4.1.12 Django versions 4.2 before 4.2.6 Description The issue is related to the django.utils.text.Truncator chars and words methods when used with html=True, which can be subject to ...

PT-2023-29325 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: Emlog Pro version 2.2.0 Description: An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro allows attackers to execute arbitrary code via uploading a crafted PHP file. Recommendations: For Emlog Pro version...