PT-2023-24319 · Control Id · Idsecure

Name of the Vulnerable Software and Affected Versions: Control ID IDSecure versions 4.7.26.0 and prior Description: An uncaught exception vulnerability exists, allowing attackers to cause the main web server of IDSecure to fault and crash, resulting in a denial of service. Recommendations: For...

Mozilla Releases Security Updates for Multiple Products

Mozilla has released security updates to address vulnerabilities for Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrato...

PT-2023-14942 · Data Illusion Survey Software Solutions · Ngsurvey

Name of the Vulnerable Software and Affected Versions: Data Illusion Survey Software Solutions ngSurvey versions 2.4.28 and below Description: The issue allows for Denial of Service when a survey contains a "Text Field", "Comment Field", or "Contact Details". Recommendations: For versions 2.4.28...

PT-2023-26413 · F5 · Big-Ip Edge Client Installer

Name of the Vulnerable Software and Affected Versions: BIG-IP Edge Client Installer affected versions not specified Description: The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Recommendations: At the moment, there...

PT-2023-27166 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 9.3 through 16.0.7 GitLab CE/EE versions 16.1 through 16.1.2 GitLab CE/EE versions 16.2 through 16.2.1 Description: An issue has been discovered in GitLab CE/EE, where a Regular Expression Denial of Service was possible...

PT-2023-35930 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is reported, with a crash type indicating a heap-buffer-overflow READ 1. The crash state involves functions such as bit...

Threat Actors Exploiting Ivanti EPMM Vulnerabilities

SUMMARY The Cybersecurity and Infrastructure Security Agency CISA and the Norwegian National Cyber Security Centre NCSC-NO are releasing this joint Cybersecurity Advisory CSA in response to active exploitation of CVE-2023-35078 and CVE-2023-35081. Advanced persistent threat APT actors exploited...

APSystems Altenergy Power Control

1. EXECUTIVE SUMMARY ​CVSS v3 9.8 ​ATTENTION: Exploitable remotely / low attack complexity / public exploits available ​Vendor: APSystems ​Equipment: Altenergy Power Control ​Vulnerability: OS Command Injection 2. RISK EVALUATION ​Successful exploitation of this vulnerability may allow remote...

PT-2023-5455 · Unknown · Phppgadmin

Name of the Vulnerable Software and Affected Versions: phpPgAdmin versions 7.14.4 and earlier Description: The issue is related to the unserialize function in the phpPgAdmin web tool for administering PostgreSQL databases, which is vulnerable due to shortcomings in the deserialization mechanism...

PT-2023-26103 · Unknown · Online Shopping Portal Project

Name of the Vulnerable Software and Affected Versions: Online Shopping Portal Project version 3.1 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the Email parameter at the "/shopping/login.php" API endpoint. Recommendations: For Online...

PT-2023-1008

Name of the Vulnerable Software and Affected Versions BlueZ versions prior to the fixed version Android versions prior to 11 Linux versions with vulnerable Bluetooth stacks macOS versions with vulnerable Bluetooth stacks iOS versions with vulnerable Bluetooth stacks Description A critical Bluetoo...

PT-2023-4157 · Webmin · Webmin

Name of the Vulnerable Software and Affected Versions: Webmin version 2.021 Description: A Stored Cross-Site Scripting XSS issue was discovered in the System Logs Viewer functionality. This allows an attacker to store a malicious payload in the configuration field, which triggers the execution of...

PT-2023-11903 · Duxcms · Duxcms

Name of the Vulnerable Software and Affected Versions: DuxCMS version 2.1 Description: A Cross Site Scripting XSS issue allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or editing a post. This enables attackers to execute malicious scripts on th...

PT-2023-26744 · Unknown · University Compass

Name of the Vulnerable Software and Affected Versions: University Compass versions 2.2.0 and below Description: The issue is related to a code injection vulnerability in the org.compass.core.executor.DefaultExecutorManager.configure component. This vulnerability can be exploited by passing an...

PT-2023-26736 · Duke · Duke

Name of the Vulnerable Software and Affected Versions: Duke versions 1.2 and below Description: The issue is related to a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init. Recommendations: For Duke versions 1.2 and below, consider disabling the...

PT-2023-26366 · Zoho · Zoho Manageengine Supportcenter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Support Center Plus versions 14001 and below Description: The issue concerns a stored XSS vulnerability in the products module. Recommendations: For versions 14001 and below, update to a version above 14001 to resolve the...

PT-2023-19189 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 3.7.0 through 3.7.8 GitHub Enterprise Server versions 3.8.0 through 3.8.1 GitHub Enterprise Server versions 3.9.0 Description: An incorrect comparison issue was identified that allowed commit smuggling,...

ETIC Telecom RAS Authentication

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable with adjacent access/low attack complexity Vendor: ETIC Telecom Equipment: Remote Access Server RAS Vulnerability: Insecure Default Initialization of Resource 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

PT-2023-26468 · Kirby · Kirby

Name of the Vulnerable Software and Affected Versions: Kirby versions prior to 3.5.8.3 Kirby versions prior to 3.6.6.3 Kirby versions prior to 3.7.5.2 Kirby versions prior to 3.8.4.1 Kirby versions prior to 3.9.6 Description: A field injection vulnerability in Kirby's content storage implementati...

PT-2023-6978 · Fsmlabs · Fsmlabs Timekeeper

Name of the Vulnerable Software and Affected Versions: FSMLabs TimeKeeper versions 8.0.17 through 8.0.28 Description: The issue is related to insufficient input validation in the FSMLabs TimeKeeper software. It allows an attacker to intercept requests from various timekeeper streams and find the...