PT-2023-16430 · Unknown · Warp Mobile Client

Name of the Vulnerable Software and Affected Versions: WARP Mobile Client versions prior to 6.29 Description: The issue is due to a misconfiguration, making the WARP Mobile Client susceptible to a tapjacking attack. If an attacker installs a malicious application on a victim's device, they can...

PT-2023-26994

Name of the Vulnerable Software and Affected Versions goauthentik versions prior to 2023.5.6 goauthentik versions prior to 2023.6.2 Description The issue affects goauthentik, an open-source Identity Provider, where an attacker can determine if a username exists using a recovery flow with an...

PT-2023-17399 · Dassault Systèmes · Simulia 3Dorchestrate

Name of the Vulnerable Software and Affected Versions: SIMULIA 3DOrchestrate versions 3DEXPERIENCE R2021x through 3DEXPERIENCE R2023x Description: An OS Command Injection issue exists, allowing arbitrary command execution through a specially crafted HTTP request. Recommendations: For SIMULIA...

PT-2023-26615 · Netis Systems · Netis Systems Wf2409E

Name of the Vulnerable Software and Affected Versions: NETIS SYSTEMS WF2409E version 3.6.42541 Description: An issue in the diagnostic tools component of the admin management interface allows a remote attacker to execute arbitrary code via the ping and traceroute functions. Recommendations: For...

PT-2023-27302 · Unknown +1 · Jupyter Server +1

Name of the Vulnerable Software and Affected Versions: jupyter-server versions prior to 2.7.2 Description: The issue is related to improper cross-site credential checks on /files/ URLs, which could allow exposure of certain file contents or accessing files when opening untrusted files via "Open...

PT-2023-27641 · Tenda · Tenda Ac23

Name of the Vulnerable Software and Affected Versions: Tenda AC23 version 16.03.07.45 cn Description: The issue arises from the sub 4781A4 function not validating user-entered parameters, leading to a post-authentication stack overflow. This occurs after a user has successfully authenticated,...

PT-2023-27514 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The requestor is working with another CNA for these vulnerabilities, as informed to GitHub. No further details are provided about the issue...

PT-2023-23902 · WordPress · A. R. Jones Featured Image Pro Post Grid

Name of the Vulnerable Software and Affected Versions: A. R. Jones Featured Image Pro Post Grid plugin versions = 5.14 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a...

PT-2023-27642 · Tenda · Tenda Ac23

Name of the Vulnerable Software and Affected Versions: Tenda AC23 version 16.03.07.45 cn Description: The formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability. Recommendations: For Tenda AC23...

PT-2023-4555 · Moxa · Iologik 4000 Series

Name of the Vulnerable Software and Affected Versions: ioLogik 4000 Series ioLogik E4200 versions v1.6 and prior Description: A vulnerability has been identified where the session cookies attribute is not set properly, potentially exposing user session data to unauthorized access and manipulation...

PT-2023-26260

Name of the Vulnerable Software and Affected Versions Active Support versions 5.2.0 through 7.0.7.0 Active Support versions 6.1.7.4 and earlier Description The issue arises from ActiveSupport::EncryptedFile writing contents to a temporary file with permissions defaulted to the user's current umas...

PT-2023-27541 · Meridian +1 · Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenMNS Horizon versions 31.0.8 and earlier than 32.0.2 Meridian versions prior to 2023.1.5 Description: The file editor in OpenMNS Horizon, accessible to users with ROLE FILESYSTEM EDITOR privileges, is vulnerable to XXE injection attacks. T...

PT-2023-23831 · WordPress · Supersoju Block Referer Spam

Name of the Vulnerable Software and Affected Versions: Supersoju Block Referer Spam plugin versions 1.1.9.4 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the Supersoj...

PT-2023-36248 · Mozilla · Ca-Certificates-Mozilla

Name of the Vulnerable Software and Affected Versions: ca-certificates-mozilla versions prior to 2.62 Description: The issue is related to an update of Mozilla SSL root CAs to the 2.62 state. This update adds several new root CAs, including Atos TrustedRoot Root CA ECC G2 2020, Atos TrustedRoot...

PT-2023-11504 · Hdf5 +1 · Hdf5 +1

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.10.4 Description: The issue allows remote attackers to run arbitrary code via the creation of a crafted file, exploiting a Buffer Overflow vulnerability in the H5S close function in H5S.c. Recommendations: For HDF5 version...

PT-2023-14709 · Unknown · Horizon Web Dashboard

Name of the Vulnerable Software and Affected Versions: Horizon Web Dashboard versions 19.4.0 through 20.1.4 Description: The issue is related to an Open Redirect vulnerability via the success url parameter. This allows for potential redirection to unintended websites. Recommendations: For Horizon...

PT-2023-11613 · Samsung · Samsung Sww-3400Rw Router

Name of the Vulnerable Software and Affected Versions: Samsung sww-3400rw Router devices affected versions not specified Description: A reflected cross site scripting XSS issue was found in Samsung sww-3400rw Router devices. The issue is related to the m2 parameter of the "sess-bin/command.cgi"...

PT-2023-25960 · Riverbed · Edgeconnect Sd-Wan Orchestrator

Name of the Vulnerable Software and Affected Versions: EdgeConnect SD-WAN Orchestrator affected versions not specified Description: The web-based management interface of EdgeConnect SD-WAN Orchestrator contains multiple vulnerabilities that could allow an authenticated remote attacker to conduct...

PT-2023-4712 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 4.1M2 through 14.10.4 XWiki Platform versions prior to 14.10.5 and 15.1RC1 Description: The issue is related to a stored XSS vulnerability that can be exploited by any registered user through their user profile by...

PT-2023-26715 · Weaviate · Weaviate

Name of the Vulnerable Software and Affected Versions: Weaviate versions 1.20.0 and earlier Description: The issue is a type conversion problem that allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function. This affects users of Weaviate Server versions...