PT-2023-24442 · Unknown · Aicustomfee +1

Name of the Vulnerable Software and Affected Versions: PrestaShop module "Customization fields fee for your store" aicustomfee versions up to 0.2.0 Description: An issue in the "Customization fields fee for your store" module allows an attacker to perform SQL injection. The estimated number of...

PT-2023-26988 · Unknown · Rikunabi Next App

Name of the Vulnerable Software and Affected Versions: Rikunabi NEXT App for Android versions prior to 11.5.0 Description: The issue is related to improper authorization in the custom URL scheme handler, allowing a malicious intent to lead the vulnerable App to access an arbitrary website...

PT-2023-4589 · Cisco · Cisco Telepresence Video Communication Server +1

Name of the Vulnerable Software and Affected Versions: Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS version 14.0 Description: A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS...

PT-2023-26644 · Comfast · Comfast Cf-Xr11

Name of the Vulnerable Software and Affected Versions: COMFAST CF-XR11 version 2.7.2 Description: An issue in the software allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub 410074 function at bin/webmgnt. Recommendations: For COMFAST CF-XR11 version 2.7.2,...

PT-2023-27061

Name of the Vulnerable Software and Affected Versions llama index versions 0.7.13 and earlier Description An issue in llama index allows a remote attacker to execute arbitrary code via the exec parameter in the PandasQueryEngine function. This enables the attacker to perform unauthorized actions ...

PT-2023-4458 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 116.0.5845.96 Description: The issue is related to an inappropriate implementation in Fullscreen in Google Chrome on Android, which allowed a remote attacker to potentially spoof the contents of the Omnibox URL...

PT-2023-4463 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 116.0.5845.96 Description: The issue is related to insufficient policy enforcement in the Extensions API of Google Chrome, allowing a remote attacker to install arbitrary extensions using a specially crafted HT...

PT-2023-4393 · Onlyoffice · Onlyoffice Document Server

Name of the Vulnerable Software and Affected Versions: ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2 Description: An out of bounds memory access issue in the JavaScript File Handler component allows remote attackers to execute arbitrary code via a crafted JavaScript file. This can be...

PT-2023-22145 · Unknown · A3 Portfolio

Name of the Vulnerable Software and Affected Versions: a3 Portfolio plugin versions 3.1.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated users with author or higher privileges. This vulnerability allows an attacker to...

PT-2023-18059 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue is related to a possible permanent denial of service DoS due to resource exhaustion in the setMediaButtonBroadcastReceiver function of MediaSessionRecord.java. This could lead...

PT-2023-16576 · Opennms · Opennms Horizon +1

Name of the Vulnerable Software and Affected Versions: OpenMNS Horizon versions 31.0.8 through 32.0.2 Meridian affected versions not specified Description: The Horizon REST API includes a "users" endpoint that is vulnerable to elevation of privilege. The solution is to upgrade to a newer version...

PT-2023-27360 · Harman · Harman Infotainment

Name of the Vulnerable Software and Affected Versions: Harman Infotainment versions 20190525031613 and later Description: The issue discloses the IP address via CarPlay CTRL packets. Recommendations: For Harman Infotainment versions 20190525031613 and later, consider restricting access to CarPlay...

PT-2023-4899 · Eprosima +2 · Eprosima Fast Dds +2

Name of the Vulnerable Software and Affected Versions: eprosima Fast DDS versions prior to 2.11.0 eprosima Fast DDS versions prior to 2.10.2 eprosima Fast DDS versions prior to 2.9.2 eprosima Fast DDS versions prior to 2.6.5 Description: The issue is related to an error in exception handling in t...

PT-2023-11769 · Unknown · Kindeditor

Name of the Vulnerable Software and Affected Versions: kindeditor version 4.1.12 Description: The issue is related to a Cross Site Scripting XSS vulnerability in the content1 parameter in demo.jsp of kindeditor. This allows attackers to execute arbitrary code. Recommendations: For kindeditor...

PT-2023-24910

Name of the Vulnerable Software and Affected Versions Canto plugin for WordPress versions up to, and including, 3.0.4 Description The Canto plugin for WordPress is vulnerable to Remote File Inclusion via the wp abspath parameter. This allows unauthenticated attackers to include and execute...

PT-2023-23874 · Avalanche · Avalanche

Name of the Vulnerable Software and Affected Versions: Avalanche versions 6.3.x and below Description: An unrestricted upload of file with a dangerous type could allow an attacker to achieve remote code execution. The issue is fixed in version 6.4.1. Recommendations: For Avalanche versions 6.3.x...

PT-2023-21955 · Vladimir Statsenko · Terms Descriptions Plugin

Name of the Vulnerable Software and Affected Versions: Vladimir Statsenko Terms descriptions plugin versions = 3.4.4 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a...

PT-2023-19632 · Google · Google Chrome

Name of the Vulnerable Software and Affected Versions: Guardian/CMC versions prior to 22.6.2 Description: The issue arises under certain conditions, influenced by timing and the usage of the Chrome web browser, where the user session is not always fully invalidated upon logout. This allows an...

PT-2023-26734 · Opnsense · Opnsense Community Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: A command injection issue in the "/api/cron/settings/setJob/" component allows attackers to execute arbitrary system commands...

PT-2023-4646 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Zoom versions prior to 5.14.10 Description: The issue is related to the client-side enforcement of server-side security in Zoom clients, which may allow an authenticated user to enable information disclosure via network access. This could...