PT-2023-25148 · WordPress · Ftp Access

Name of the Vulnerable Software and Affected Versions: FTP Access WordPress plugin versions 1.0 and earlier Description: The issue concerns a lack of authorization and CSRF checks when updating settings in the plugin, along with missing sanitization and escaping. This allows any authenticated use...

PT-2023-27385 · Canonical +2 · Moodle

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: No details are provided about the issue. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

PT-2023-11520 · D Link · Dlink 619L

Name of the Vulnerable Software and Affected Versions: DLINK 619L version B 2.06beta Description: A buffer overflow issue exists via the FILECODE parameter on login, which can be exploited. Recommendations: For DLINK 619L version B 2.06beta, avoid using the FILECODE parameter in the login process...

PT-2023-27545 · Sap · Sap Business Objects Installer

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Suite Installer versions 420, 430 Description: The issue allows an attacker within the network to create a directory under a temporary directory and link it to a directory with operating system files. On successful...

PT-2023-5379 · Isc +4 · Bind 9 +4

Name of the Vulnerable Software and Affected Versions: BIND 9 versions 9.18.0 through 9.18.18 BIND 9 versions 9.18.11-S1 through 9.18.18-S1 Description: A flaw in the networking code handling DNS-over-TLS queries may cause named to terminate unexpectedly due to an assertion failure. This happens...

CISA, FBI, and CNMF Release Advisory on Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

Today, CISA, Federal Bureau of Investigation FBI, and U.S. Cyber Command’s Cyber National Mission Force CNMF published a joint Cybersecurity Advisory CSA, Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475. This CSA provides information on an incident at an Aeronautical...

PT-2023-12119 · Mofi Network · Mofi4500-4Gxelte-V2

Name of the Vulnerable Software and Affected Versions: MoFi Network MOFI4500-4GXeLTE-V2 version 3.5.6-xnet-5052 Description: An issue was discovered that allows attackers to bypass authentication and execute arbitrary code via a crafted HTTP request. Recommendations: For MoFi Network...

CISA Releases Update to Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells

The Cybersecurity and Infrastructure Security Agency CISA has released an update to a previously published Cybersecurity Advisory CSA, Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells. The CSA—originally released to warn network defenders of critical infrastructure organizations...

PT-2023-28168 · Jenkins · Jenkins Job Configuration History Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Job Configuration History Plugin versions 1227.v7a 79fc4dc01f and earlier Description: The issue allows attackers to manipulate the configuration history rendered by Jenkins, as the 'name' query parameter is not restricted when...

PT-2023-26513 · Tp Link · Archer C9 +1

Name of the Vulnerable Software and Affected Versions: Archer C1200 versions prior to Archer C1200JP V2 230508 Archer C9 versions prior to Archer C9JP V3 230508 Description: The issue allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Recommendations: For Archer...

PT-2023-5472

Name of the Vulnerable Software and Affected Versions iOS versions prior to 16.7 iPadOS versions prior to 16.7 macOS Ventura versions prior to 13.6 watchOS versions prior to 9.6.3 watchOS versions prior to 10.0.1 Description A certificate validation issue was addressed, which may allow a maliciou...

PT-2023-28184 · Jenkins · Jenkins Frugal Testing Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Frugal Testing Plugin versions 1.1 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to Frugal Testing using attacker-specified credentials, and to retrieve test IDs and names from...

PT-2023-26842 · Softneta · Meddream Pacs

Name of the Vulnerable Software and Affected Versions: Softneta MedDream PACS affected versions not specified Description: The issue concerns the storage of usernames and passwords in plaintext. This could be exploited by attackers to leak legitimate users' credentials. Recommendations: At the...

PT-2023-6521

Name of the Vulnerable Software and Affected Versions WireMock versions prior to 2.35.1 WireMock versions prior to 3.0.3 Description The issue is related to insufficient checking of incoming requests in WireMock, a tool for mocking HTTP services. This can allow a remote attacker to redirect POST...

PT-2023-7036

Name of the Vulnerable Software and Affected Versions Electron versions prior to 26.0.0-beta.13 Electron versions prior to 25.5.0 Electron versions prior to 24.7.1 Electron versions prior to 23.3.13 Electron versions prior to 22.3.19 Description The issue is related to improper code generation...

PT-2023-26605 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: A security issue has been identified. No further details are provided about the nature of the issue or its potential impact. Recommendations: At...

PT-2023-4981 · Aruba · Aruba 9000 Series Gateways +3

Name of the Vulnerable Software and Affected Versions: Aruba 9200 and 9000 Series Controllers and Gateways affected versions not specified Description: Vulnerabilities exist in the BIOS implementation that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker...

SUSE-SU-2023:3536-1 Security update for docker

This update for docker fixes the following issues: - Update to Docker 24.0.5-ce. See upstream changelong online at bsc1213229 - Update to Docker 24.0.4-ce. See upstream changelog online at . bsc1213500 - Update to Docker 24.0.3-ce. See upstream changelog online at . bsc1213120 - Recommend...

Festo MSE6-C2M/D2M/E2M

SUMMARY Incomplete user documentation of undocumented, authenticated test mode and further remote accessible functions. The supported features may be covered only partly by the corresponding user documentation. Festo developed the products according to the respective state of the art. As a...

Fujitsu Limited Real-time Video Transmission Gear "IP series"

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: Fujitsu Limited Equipment: Real-time Video Transmission Gear "IP series" Vulnerability: Use Of Hard-Coded Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker logging into...