DEBIAN-CVE-2023-1449

A vulnerability has been found in GPAC 2.3-DEV-rev35-gbbca86917-master and classified as problematic. This vulnerability affects the function gfav1resetstate of the file mediatools/avparsers.c. The manipulation leads to double free. It is possible to launch the attack on the local host. The explo...

UBUNTU-CVE-2023-1452

A vulnerability was found in GPAC 2.3-DEV-rev35-gbbca86917-master. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file filters/loadtext.c. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit...

UBUNTU-CVE-2023-1448

A vulnerability, which was classified as problematic, was found in GPAC 2.3-DEV-rev35-gbbca86917-master. This affects the function gfm2tsprocesssdt of the file mediatools/mpegts.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been...

CVE-2023-1448 GPAC mpegts.c gf_m2ts_process_sdt heap-based overflow

A vulnerability, which was classified as problematic, was found in GPAC 2.3-DEV-rev35-gbbca86917-master. This affects the function gfm2tsprocesssdt of the file mediatools/mpegts.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been...

PT-2023-27907 · Knplabs · Knplabs/Knp-Snappy

Name of the Vulnerable Software and Affected Versions: knplabs/knp-snappy versions prior to 1.4.3 Description: The issue concerns a PHAR deserialization vulnerability in the knplabs/knp-snappy PHP library. This vulnerability allows an attacker to gain remote code execution by exploiting the lack ...

PT-2023-20798 · Unknown · Kirin Fortress Machine

Name of the Vulnerable Software and Affected Versions: Kirin Fortress Machine version 1.7-2020-0610 Description: A SQL Injection issue allows attackers to execute arbitrary code via the "/admin.php?controller=admin commonuser" API endpoint, specifically through the controller parameter. This...

PT-2023-13667 · WordPress · Themekraft Post Form

Name of the Vulnerable Software and Affected Versions: ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin versions = 2.7.5 Description: The issue is a Stored Cross-Site Scripting XSS vulnerability. This means that an attacker ca...

PT-2023-18227 · Unknown · Decon Driver

Name of the Vulnerable Software and Affected Versions: decon driver versions prior to SMR Mar-2023 Release 1 Description: The issue is related to a use after free vulnerability in the decon driver, which allows attackers to cause a memory access fault. Recommendations: For versions prior to SMR...

# configureLP function should check LP stakers present before changing LP address.

Lines of code Vulnerability details configureLP function should check LP stakers existence before changing LP address. Permitted users are allowed to change LP address when lpLocked is false. So this does not follow the comments above. Proof of concept 1701 This function allows a permitted user t...

PT-2023-20262 · Plainware · Store Locator

Name of the Vulnerable Software and Affected Versions: Plainware Locatoraid Store Locator plugin versions = 3.9.11 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a we...

PT-2023-2590 · Linux +10 · Linux Kernel +10

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf group detach function did not check the...

wrong updating lp position

Lines of code Vulnerability details Impact lock lp token at staking more than required when user adds some lp token staking amount, contract uses new timelockEndTime for previously staked amount . Proof of Concept Scenario : user have some amount of lp token staked for a period of time like 30 da...

PT-2023-21558 · Opensips · Opensis

Name of the Vulnerable Software and Affected Versions: OpenSIPS versions prior to 3.1.7 OpenSIPS versions prior to 3.2.4 Description: OpenSIPS is a Session Initiation Protocol SIP server implementation. A specially crafted Authorization header causes OpenSIPS to crash or behave in an unexpected w...

PT-2023-1904 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.7 and earlier Description: The issue is related to an out-of-bounds read vulnerability in Adobe Dimension when parsing a crafted file. This could result in reading past the end of an allocated memory structure,...

PT-2023-1924 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.7 and earlier Description: The issue is related to an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could...

PT-2023-1922 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.7 and earlier Description: The issue is related to an out-of-bounds read vulnerability when processing USD files, which could allow an attacker to execute arbitrary code using a specially crafted malicious file...

PT-2023-1868 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows versions prior to the fixed version Description: The issue is related to insufficient input validation in the HTTP protocol stack implementation, specifically in the http.sys component of Windows operating systems. This can be exploit...

PT-2023-1832 · Adobe · Substance3D - Stager

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Stager versions 2.0.0 and earlier Description: The issue is a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, where a vict...

PT-2023-21226 · Panindex · Panindex

Name of the Vulnerable Software and Affected Versions: PanIndex versions prior to 3.1.3 Description: The issue concerns a hard-coded JWT key PanIndex used in PanIndex. This allows an attacker to sign a JWT token and perform actions with admin privileges. Recommendations: For versions prior to...

PT-2023-16092 · WordPress · Fluentsmtp

Name of the Vulnerable Software and Affected Versions: FluentSMTP WordPress plugin versions prior to 2.2.3 Description: The issue arises from the plugin's failure to sanitize or escape email content, making it susceptible to stored cross-site scripting attacks XSS when an administrator views the...