PT-2023-24372 · Softexpert · Softexpert Excellence Suite

Name of the Vulnerable Software and Affected Versions: SoftExpert Excellence Suite version 2.1.9 Description: The issue is related to Cross Site Scripting XSS and can be exploited via query screens. This means an attacker could potentially inject malicious scripts into the website, which would th...

PT-2023-25044 · Ujcms · Ujcms

Name of the Vulnerable Software and Affected Versions: Ujcms version 6.0.2 Description: An issue in Ujcms allows attackers to gain sensitive information via the dir parameter to the "/api/backend/core/web-file-html/download-zip" API endpoint. Recommendations: For Ujcms version 6.0.2, as a tempora...

PT-2023-23727 · Zhong Bang · Crmeb

Name of the Vulnerable Software and Affected Versions: Zhong Bang CRMEB versions up to 4.6.0 Description: A critical issue affects the Image Upload component, specifically the file /api/wechat/app auth, leading to deserialization due to some unknown processing. Recommendations: For versions up to...

PT-2023-23754 · Otcms · Otcms

Name of the Vulnerable Software and Affected Versions: OTCMS versions up to 6.62 Description: A critical issue was discovered, affecting unknown code. The manipulation of the username and password arguments with the input admin leads to the use of a hard-coded password. Recommendations: For OTCMS...

PT-2023-11617 · Unknown · Sogo Web Mail

Name of the Vulnerable Software and Affected Versions: SOGo Web Mail versions prior to 4.3.1 Description: The issue allows attackers to obtain user sensitive information when a user reads an email containing malicious code. This is due to a Cross Site Scripting XSS vulnerability. Recommendations:...

PT-2023-23747 · Mccms · Mccms

Name of the Vulnerable Software and Affected Versions: mccms versions up to 2.6.5 Description: A critical issue has been found, affecting the pic save function of the file sys/apps/controllers/admin/Comic.php. The manipulation of the pic argument leads to server-side request forgery, which can be...

PT-2023-3755 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Zoom versions prior to 5.14.0 Description: The issue is related to an improper restriction of operations within the bounds of a memory buffer, which can be exploited by a remote attacker to execute arbitrary code. This can potentially cause...

PT-2023-3743 · Sap · Sap Netweaver Enterprise Portal

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Enterprise Portal version 7.50 Description: The issue arises from insufficient encoding of user-controlled inputs over the network, resulting in a reflected Cross-Site Scripting XSS issue. This allows an attacker to view or modi...

PT-2023-3710 · Unknown · Sspanel-Uim

Name of the Vulnerable Software and Affected Versions: SSPanel-Uim version 2023.3 Description: The issue is related to improper authorization in the /link/ interface of the SSPanel-Uim software. This can allow an attacker to gain access to confidential information, potentially leading to a leak o...

PT-2023-23326 · Systemd +1 · Systemd +1

Name of the Vulnerable Software and Affected Versions: systemd version 253 Description: An issue was discovered where an attacker can truncate a sealed log file and then resume log sealing, allowing modifications to go undetected despite integrity checks showing no error. Recommendations: For...

PT-2023-3184 · Microsoft · Sharepoint Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Server Subscription Edition affected versions not specified Description: The issue is related to insufficient access control in Microsoft SharePoint Server,...

PT-2023-24272 · Unknown · Giturlparse

Name of the Vulnerable Software and Affected Versions: git-url-parse versions 0.4.4 and earlier Description: The issue allows Regular Expression Denial of Service ReDos via a crafted URL to normalize url in lib.rs. This is similar to an issue found in Python. Recommendations: For versions 0.4.4 a...

PT-2023-25070 · Asus · Asus Rt-N10Lx Router

Name of the Vulnerable Software and Affected Versions: Asus RT-N10LX Router version 2.0.0.39 Description: A stack overflow issue was discovered via the mac parameter at the "/start-apply.html" API endpoint. This issue only affects products that are no longer supported by the maintainer...

PT-2023-25036 · Youxun Electronic Equipment (Shanghai) Co. · Ac Centralized Management Platform

Name of the Vulnerable Software and Affected Versions: Youxun Electronic Equipment Shanghai Co., Ltd AC Centralized Management Platform version 1.02.040 Description: A Cross Site Scripting XSS issue allows attackers to execute arbitrary code via uploading a crafted HTML file to the "upfile.cgi" A...

PT-2023-20511

Name of the Vulnerable Software and Affected Versions dottie versions prior to 2.0.4 Description The issue is related to Prototype Pollution due to insufficient checks. It can be exploited via the set function and the current variable in the /dottie.js file. Recommendations For versions prior to...

PT-2023-23502 · Owncast · Owncast

Name of the Vulnerable Software and Affected Versions: owncast/owncast versions prior to 0.1.0 Description: The issue is related to Server-Side Request Forgery SSRF in the owncast/owncast GitHub repository. This allows an attacker to make requests to internal services that are not intended for...

PT-2023-22400 · Unknown · Facemoji Emoji Keyboard

Name of the Vulnerable Software and Affected Versions: Facemoji Emoji Keyboard version 2.9.1.2 Description: The issue allows unauthorized apps to cause escalation of privilege attacks by manipulating a component. Recommendations: For Facemoji Emoji Keyboard version 2.9.1.2, consider restricting...

PT-2023-25074 · Chamilo · Chamilo

Name of the Vulnerable Software and Affected Versions: Chamilo versions 1.11. up to 1.11.18 Description: The issue allows attackers to execute a Server-Side Request Forgery SSRF and obtain information on the services running on the server via crafted requests in the social and links tools...

PT-2023-24926 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 v4 version US AC10V4.0si V16.03.10.13 cn Description: A stack overflow issue was discovered via the parameter list at the "/goform/SetNetControlList" API endpoint. This issue affects the Tenda AC10 v4 router. Recommendations: For...

PT-2023-4246 · Sap · Sap Message Server

Name of the Vulnerable Software and Affected Versions: SAP Message Server versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT Description: The issue is related to the Access Control List ACL of the SAP Message...