PT-2023-27166 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 9.3 through 16.0.7 GitLab CE/EE versions 16.1 through 16.1.2 GitLab CE/EE versions 16.2 through 16.2.1 Description: An issue has been discovered in GitLab CE/EE, where a Regular Expression Denial of Service was possible...

PT-2023-26413 · F5 · Big-Ip Edge Client Installer

Name of the Vulnerable Software and Affected Versions: BIG-IP Edge Client Installer affected versions not specified Description: The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Recommendations: At the moment, there...

PT-2023-35930 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is reported, with a crash type indicating a heap-buffer-overflow READ 1. The crash state involves functions such as bit...

Threat Actors Exploiting Ivanti EPMM Vulnerabilities

SUMMARY The Cybersecurity and Infrastructure Security Agency CISA and the Norwegian National Cyber Security Centre NCSC-NO are releasing this joint Cybersecurity Advisory CSA in response to active exploitation of CVE-2023-35078 and CVE-2023-35081. Advanced persistent threat APT actors exploited...

APSystems Altenergy Power Control

1. EXECUTIVE SUMMARY ​CVSS v3 9.8 ​ATTENTION: Exploitable remotely / low attack complexity / public exploits available ​Vendor: APSystems ​Equipment: Altenergy Power Control ​Vulnerability: OS Command Injection 2. RISK EVALUATION ​Successful exploitation of this vulnerability may allow remote...

PT-2023-5455 · Unknown · Phppgadmin

Name of the Vulnerable Software and Affected Versions: phpPgAdmin versions 7.14.4 and earlier Description: The issue is related to the unserialize function in the phpPgAdmin web tool for administering PostgreSQL databases, which is vulnerable due to shortcomings in the deserialization mechanism...

PT-2023-26103 · Unknown · Online Shopping Portal Project

Name of the Vulnerable Software and Affected Versions: Online Shopping Portal Project version 3.1 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the Email parameter at the "/shopping/login.php" API endpoint. Recommendations: For Online...

PT-2023-1008

Name of the Vulnerable Software and Affected Versions BlueZ versions prior to the fixed version Android versions prior to 11 Linux versions with vulnerable Bluetooth stacks macOS versions with vulnerable Bluetooth stacks iOS versions with vulnerable Bluetooth stacks Description A critical Bluetoo...

PT-2023-4157 · Webmin · Webmin

Name of the Vulnerable Software and Affected Versions: Webmin version 2.021 Description: A Stored Cross-Site Scripting XSS issue was discovered in the System Logs Viewer functionality. This allows an attacker to store a malicious payload in the configuration field, which triggers the execution of...

PT-2023-11903 · Duxcms · Duxcms

Name of the Vulnerable Software and Affected Versions: DuxCMS version 2.1 Description: A Cross Site Scripting XSS issue allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or editing a post. This enables attackers to execute malicious scripts on th...

PT-2023-26736 · Duke · Duke

Name of the Vulnerable Software and Affected Versions: Duke versions 1.2 and below Description: The issue is related to a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init. Recommendations: For Duke versions 1.2 and below, consider disabling the...

PT-2023-26366 · Zoho · Zoho Manageengine Supportcenter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Support Center Plus versions 14001 and below Description: The issue concerns a stored XSS vulnerability in the products module. Recommendations: For versions 14001 and below, update to a version above 14001 to resolve the...

PT-2023-26744 · Unknown · University Compass

Name of the Vulnerable Software and Affected Versions: University Compass versions 2.2.0 and below Description: The issue is related to a code injection vulnerability in the org.compass.core.executor.DefaultExecutorManager.configure component. This vulnerability can be exploited by passing an...

PT-2023-19189 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 3.7.0 through 3.7.8 GitHub Enterprise Server versions 3.8.0 through 3.8.1 GitHub Enterprise Server versions 3.9.0 Description: An incorrect comparison issue was identified that allowed commit smuggling,...

PT-2023-26468 · Kirby · Kirby

Name of the Vulnerable Software and Affected Versions: Kirby versions prior to 3.5.8.3 Kirby versions prior to 3.6.6.3 Kirby versions prior to 3.7.5.2 Kirby versions prior to 3.8.4.1 Kirby versions prior to 3.9.6 Description: A field injection vulnerability in Kirby's content storage implementati...

ETIC Telecom RAS Authentication

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable with adjacent access/low attack complexity Vendor: ETIC Telecom Equipment: Remote Access Server RAS Vulnerability: Insecure Default Initialization of Resource 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

PT-2023-4341 · Solarwinds · Solarwinds Orion Platform

Name of the Vulnerable Software and Affected Versions: SolarWinds Orion Platform affected versions not specified Description: The issue allows users with administrative access to the SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges. This is due to an Incorrect...

PT-2023-26079 · Unknown · October Cms

Name of the Vulnerable Software and Affected Versions: October CMS version 3.4.4 Description: The issue allows attackers to execute arbitrary code via a crafted file, specifically an svg file, which can be uploaded to the system. This can be done in the context of a browser and requires the...

PT-2023-6978 · Fsmlabs · Fsmlabs Timekeeper

Name of the Vulnerable Software and Affected Versions: FSMLabs TimeKeeper versions 8.0.17 through 8.0.28 Description: The issue is related to insufficient input validation in the FSMLabs TimeKeeper software. It allows an attacker to intercept requests from various timekeeper streams and find the...

PT-2023-19048 · Unknown · Command Centre

Name of the Vulnerable Software and Affected Versions: Command Centre versions vEL8.40 and prior Command Centre version vEL8.50 prior to vEL8.50.2831 MR8 Command Centre version vEL8.60 prior to vEL8.60.2347 MR6 Command Centre version vEL8.70 prior to vEL8.70.2185 MR4 Command Centre version vEL8.8...