PT-2023-24879 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.3 through 15.11.9 GitLab CE/EE versions 16.0 through 16.0.5 GitLab CE/EE versions 16.1 through 16.1.0 Description: An issue has been discovered in GitLab CE/EE, which allows an attacker to merge arbitrary code into...

PT-2023-26089 · Unknown · Maid Hiring Management System

Name of the Vulnerable Software and Affected Versions: Maid Hiring Management System version 1.0 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability is present in the /admin/search-booking-request.php component. Cross-site scripting XSS is a type of...

CISA and FBI Release Cybersecurity Advisory on Enhanced Monitoring to Detect APT Activity Targeting Outlook Online

The Cybersecurity and Infrastructure Security Agency CISA and Federal Bureau of Investigation FBI have released a joint Cybersecurity Advisory CSA, Enhanced Monitoring to Detect APT Activity Targeting Outlook Online, to provide guidance to agencies and critical infrastructure organizations on...

Enhanced Monitoring to Detect APT Activity Targeting Outlook Online

SUMMARY In June 2023, a Federal Civilian Executive Branch FCEB agency identified suspicious activity in their Microsoft 365 M365 cloud environment. The agency reported the activity to Microsoft and the Cybersecurity and Infrastructure Security Agency CISA, and Microsoft determined that advanced...

PT-2023-26048 · Unknown · Codeprojects Online Restaurant Management System

Name of the Vulnerable Software and Affected Versions: Code-projects Online Restaurant Management System version 1.0 Description: The issue allows an attacker to perform SQL injection, which can be used to bypass the admin panel. This enables the attacker to view order records, add items, and...

PT-2023-24553 · Unknown · Fm Service

Name of the Vulnerable Software and Affected Versions: FM service affected versions not specified Description: The issue is related to a possible missing parameters check in the FM service. This could lead to a local denial of service, and system execution privileges are needed to exploit it...

PT-2023-26212 · Jenkins · Jenkins Benchmark Evaluator Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Benchmark Evaluator Plugin versions 1.0.1 and earlier Description: A missing permission check in the Jenkins Benchmark Evaluator Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check...

PT-2023-4003 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS on MX Series versions prior to 19.1R3-S10 Juniper Networks Junos OS on MX Series 19.2 versions prior to 19.2R3-S7 Juniper Networks Junos OS on MX Series 19.3 versions prior to 19.3R3-S8 Juniper Networks Junos OS on M...

PT-2023-20259 · WordPress · Pagup Wordpress Robots.Txt Optimization Plugin

Name of the Vulnerable Software and Affected Versions: Pagup WordPress Robots.Txt optimization plugin versions 1.4.5 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-4096 · Sap · Sap Enable Now

Name of the Vulnerable Software and Affected Versions: SAP Enable Now versions WPB MANAGER 1.0, WPB MANAGER CE 10, WPB MANAGER HANA 10, ENABLE NOW CONSUMP DEL 1704 Description: The issue is related to the absence of the X-Content-Type-Options response header, which allows an unauthenticated...

PT-2023-14770 · WordPress · Galleryplugins Video Contest

Name of the Vulnerable Software and Affected Versions: GalleryPlugins Video Contest WordPress plugin versions = 3.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended action...

PT-2023-4100 · Sap · Sap Solution Manager

Name of the Vulnerable Software and Affected Versions: SAP Solution Manager Diagnostics agent version 7.20 Description: The issue is related to insufficient validation of incoming requests, allowing an unauthenticated attacker to execute HTTP requests blindly. Successful exploitation can lead to ...

PT-2023-19567 · WordPress · Scott Paterson Contact Form 7 – Paypal & Stripe Add-On

Name of the Vulnerable Software and Affected Versions: Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin versions prior to 1.9.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into...

Two Spyware Apps on Google Play with 1.5 Million Users Sending Data to China

Two file management apps on the Google Play Store have been discovered to be spyware, putting the privacy and security of up to 1.5 million Android users at risk. These apps engage in deceptive behaviour and secretly send sensitive user data to malicious servers in China. Pradeo, a leading mobile...

PT-2023-12345 · Ibm · Ibm Cloud Object System

Name of the Vulnerable Software and Affected Versions: IBM Cloud Object System version 3.15.8.97 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session. Th...

PT-2023-25818 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: A command injection issue was found in the setTracerouteCfg function via the command parameter. Recommendations: For version 17.0.0cu.557 B20221024, consider disabling the...

2023.2 IPU – BIOS Advisory

Summary: Potential security vulnerabilities in BIOS firmware for some Intel® Processors may allow escalation of privilege and information disclosure. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2022-33894 Description: Improper...

PT-2023-25817 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: A command injection issue was found in the setDiagnosisCfg function via the ip parameter. Recommendations: For version 17.0.0cu.557 B20221024, avoid using the ip parameter in the...

PT-2023-19050 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: An access violation issue exists in the eventcore functionality. A specially crafted network request can lead to denial of service. An attacker can send a network request to trigger this issue...

PT-2023-19666 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: A command injection issue exists in the vtysh ubus tool's toolsh excute.constprop.1 functionality, specifically within the ping tool utility. This allows an attacker to execute commands by sending...