PT-2023-4711 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a heap buffer overflow in the btm ble update inq result function of btm ble gap.cc, which could lead to a possible out of bounds read. This may result in local information...

PT-2023-17982 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a possible out of bounds read in the gatt dbg op name function of gatt utils.cc due to a missing bounds check. This could lead to local information disclosure in the Bluetooth...

PT-2023-24441 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: Church CRM version 4.5.3 Description: Multiple cross-site scripting XSS vulnerabilities were discovered in Church CRM. The issue affects the GroupReports.php file via the GroupRole, ReportModel, and OnlyCart parameters. Recommendations: For...

PT-2023-23736 · Ibm · Ibm Business Automation Workflow

Name of the Vulnerable Software and Affected Versions: IBM Business Automation Workflow affected versions not specified Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure withi...

PT-2024-7270

Name of the Vulnerable Software and Affected Versions: REXML versions prior to 3.2.6 REXML versions prior to 3.3.1 REXML versions prior to 3.3.2 REXML versions prior to 3.3.3 Description: The REXML gem has a denial of service vulnerability when it parses an XML that has many s in an attribute...

PT-2023-25023 · Microworld Technologies · Escan Management Console

Name of the Vulnerable Software and Affected Versions: Microworld Technologies eScan Management console version 14.0.1400.2281 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via a vulnerable parameter GrpPath. Recommendations: For version...

PT-2023-11499 · Unknown · Chaoji Cms

Name of the Vulnerable Software and Affected Versions: Chaoji CMS version 2.18 Description: The issue is a stored cross-site scripting XSS vulnerability. It affects the /index.php?admin-master-navmenu-add endpoint of Chaoji CMS, allowing attackers to execute arbitrary code. Recommendations: For...

PT-2023-5440 · Ibm · Ibm Robotic Process Automation For Cloud Pak

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation for Cloud Pak versions 21.0.1 through 21.0.7.3 IBM Robotic Process Automation for Cloud Pak versions 23.0.0 through 23.0.3 Description: The issue is related to insufficient security configuration, which may allo...

PT-2023-22256 · Cththemes · Cththemes Theroof Theme +1

Name of the Vulnerable Software and Affected Versions: CTHthemes TheRoof theme versions 1.0.3 and earlier CTHthemes TheRoof plugin versions 1.0.3 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject...

PT-2023-25022 · Microworld Technologies · Escan Management Console

Name of the Vulnerable Software and Affected Versions: Microworld Technologies eScan Management console version 14.0.1400.2281 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via a crafted script to the Dtltyp and ListName parameters. Recommendations:...

PT-2023-9651 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js versions 20 Description: The issue arises from a missing check in the fs.mkdtemp API, allowing a malicious actor to bypass the permission model check using a path traversal attack. This can lead to the creation of an arbitrary...

PT-2023-17193 · Unknown · Faveo Helpdesk Enterprise

Name of the Vulnerable Software and Affected Versions: Faveo Helpdesk Enterprise version 6.0.1 Description: The issue allows an attacker with agent permissions to perform privilege escalation on the application due to a stored XSS vulnerability. Recommendations: For Faveo Helpdesk Enterprise...

PT-2023-22148 · Dream Theme · The7

Name of the Vulnerable Software and Affected Versions: Dream-Theme The7 plugin versions prior to 11.6.0 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into a website, potentially leading to...

PT-2023-24636 · Unknown · Andy Moyle Church Admin

Name of the Vulnerable Software and Affected Versions: Andy Moyle Church Admin plugin versions 3.7.29 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into websites, potentially leading t...

PT-2023-17241 · Unknown · Orangescrum

Name of the Vulnerable Software and Affected Versions: OrangeScrum version 2.0.11 Description: The issue allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF...

PT-2023-23751 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15.7.6 iOS versions prior to 16.5 iPadOS versions prior to 15.7.6 iPadOS versions prior to 16.5 Description: The issue allows a deleted photo to be re-surfaced without authentication through the Shake-to-undo feature. Th...

PT-2023-25545 · Unknown · Pos Codekop

Name of the Vulnerable Software and Affected Versions: POS Codekop version 2.0 Description: The issue is related to an authenticated remote code execution RCE vulnerability. It can be exploited via the filename parameter. Recommendations: For POS Codekop version 2.0, consider restricting access t...

WordPress WP Activity Log Plugin < 4.5.2 is vulnerable to Sensitive Data Exposure

Software WP Activity Log Type Plugin Vulnerable versions 4.5.2 Fixed in 4.5.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-2261 Patch priority Medium CVSS severity Medium 4.3 Developer Melapress PSID 40c85e58b056 Credits Marco Wotschka Required...

PT-2023-12446 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns over 70 plugins and themes that are vulnerable to Cross-Site Request Forgery due to improperly implemented nonce protection that could be bypassed. Recommendation...

PT-2023-4695 · Libtiff +3 · Libtiff +3

Name of the Vulnerable Software and Affected Versions: libtiff version 4.5.0 Description: The issue is caused by a buffer overflow on the stack in the extractContigSamplesShifted8bits function of the LibTIFF library, located in /libtiff/tools/tiffcrop.c. This can allow an attacker to cause a deni...