PT-2023-7504 · D Link · D-Link Dar-7000

Name of the Vulnerable Software and Affected Versions: D-Link DAR-7000 up to 20231126 Description: A critical vulnerability has been found in the D-Link DAR-7000, affecting the file /user/inc/workidajax.php. The issue is related to the lack of protection against SQL injection when handling the id...

PT-2023-30775 · Unknown · Capsule-Proxy

Name of the Vulnerable Software and Affected Versions: capsule-proxy versions prior to 0.4.6 Description: The issue is a privilege escalation vulnerability based on a missing check if the user is authenticated based on the TokenReview result. This affects clusters running with the anonymous-auth...

PT-2023-31143 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.7 Description: The Google Analytics element in Uptime Kuma is vulnerable to Attribute Injection, leading to Cross-Site-Scripting XSS attacks. This occurs because the custom status interface can set an...

PT-2023-7469 · Openssl · Openssl

Name of the Vulnerable Software and Affected Versions: openssl aka node-openssl versions through 2.0.0 Description: The issue is related to the absence of input data sanitization in the openssl package of the NPM package manager. This allows a remote attacker to execute arbitrary commands by...

PT-2023-7273 · Sysaid · Sysaid

Name of the Vulnerable Software and Affected Versions: SysAid versions prior to 23.2.15 Description: The issue allows for Indirect Object Reference IDOR attacks, enabling unauthorized access to protected information. This can be achieved by modifying the sid parameter to EmailHtmlSourceIframe.jsp...

PT-2023-28688 · Dell · Powerprotect Agent For File System

Name of the Vulnerable Software and Affected Versions: PowerProtect Agent for File System versions 19.14 and prior Description: The issue is related to incorrect default permissions in the ddfscon component, allowing a low-privileged local attacker to potentially overwrite log files...

PT-2023-31056 · 7 Zip · 7Za

Name of the Vulnerable Software and Affected Versions: NZBGet version 21.1 Description: The issue allows authenticated remote code execution due to the unarchive programs 7za and unrar preserving executable file permissions. An attacker with Control capability can execute a file by setting the...

PT-2023-32557 · Unknown · Getsimple Cms

Name of the Vulnerable Software and Affected Versions: GetSimpleCMS versions 3.3.16 through 3.4.0a Description: A critical issue affects the processing of the file /admin/theme-edit.php, leading to code injection. The attack can be initiated remotely. Recommendations: For versions 3.3.16 through...

PT-2023-30726 · Grocy · Grocy

Name of the Vulnerable Software and Affected Versions: Grocy version 4.0.3 Description: The issue allows a local attacker to execute arbitrary code and obtain sensitive information via the equipment description component within the "/equipment/" component. Recommendations: For Grocy version 4.0.3...

PT-2023-30695 · Unknown · Xxl-Job-Admin

Name of the Vulnerable Software and Affected Versions: xxl-job-admin version 2.4.0 Description: The issue allows for Remote Code Execution RCE via the /xxl-job-admin/jobcode/save API endpoint. Recommendations: For xxl-job-admin version 2.4.0, as a temporary workaround, consider restricting access...

PT-2023-29805 · Unknown · Code-Projects Simple Task List

Name of the Vulnerable Software and Affected Versions: Code-Projects Simple Task List version 1.0 Description: A SQL injection issue allows attackers to obtain sensitive information by manipulating the status parameter in the "addTask.php" file. Recommendations: For Code-Projects Simple Task List...

PT-2023-9516 · Openlink +4 · Virtuoso-Opensource +4

Name of the Vulnerable Software and Affected Versions: openlink virtuoso-opensource version 7.2.11 Description: The issue is related to the incorrect implementation of the sequence of actions in the cha cmp component of the Virtuoso-opensource web application development platform. Exploitation of...

PT-2023-7136 · Adobe · Audition

Name of the Vulnerable Software and Affected Versions: Adobe Audition versions 24.0 and earlier Adobe Audition versions 23.6.1 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this...

PT-2023-7690 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 120.0.6099.109 Description: The issue is related to a use after free in Blink, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code...

PT-2023-7288 · Unknown · Weston Embedded Uc-Http

Name of the Vulnerable Software and Affected Versions: Weston Embedded uC-HTTP version 3.01.01 Description: A memory corruption issue exists in the HTTP Server header parsing functionality. This can be exploited by sending specially crafted network packets, potentially leading to code execution. ...

PT-2023-32514 · Unknown · Maiwei Safety Production Control Platform

Name of the Vulnerable Software and Affected Versions: Maiwei Safety Production Control Platform version 4.1 Description: A problematic issue was found in the Maiwei Safety Production Control Platform, affecting the /api/DataDictionary/GetItemList API endpoint. This issue leads to information...

PT-2023-30687 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /admin/task/run component. This allows for unauthorized actions to be performed on behalf of an authenticated user. Recommendations: For...

PT-2023-30457 · Knovos · Knovos Discovery

Name of the Vulnerable Software and Affected Versions: Knovos Discovery version 22.67.0 Description: An issue in the software allows a remote attacker to obtain sensitive information via the "/DiscoveryReview/Service/CaseManagement.svc/GetProductSiteName" component. Recommendations: For Knovos...

PT-2023-23149 · Unknown · Chronosly Events Calendar

Name of the Vulnerable Software and Affected Versions: Chronosly Events Calendar plugin versions = 2.6.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

PT-2023-23992 · WordPress · Woocommerce Product Recommendations

Name of the Vulnerable Software and Affected Versions: WooCommerce Product Recommendations plugin versions = 2.3.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions...