PT-2023-25070 · Asus · Asus Rt-N10Lx Router

Name of the Vulnerable Software and Affected Versions: Asus RT-N10LX Router version 2.0.0.39 Description: A stack overflow issue was discovered via the mac parameter at the "/start-apply.html" API endpoint. This issue only affects products that are no longer supported by the maintainer...

PT-2023-25036 · Youxun Electronic Equipment (Shanghai) Co. · Ac Centralized Management Platform

Name of the Vulnerable Software and Affected Versions: Youxun Electronic Equipment Shanghai Co., Ltd AC Centralized Management Platform version 1.02.040 Description: A Cross Site Scripting XSS issue allows attackers to execute arbitrary code via uploading a crafted HTML file to the "upfile.cgi" A...

PT-2023-24272 · Unknown · Giturlparse

Name of the Vulnerable Software and Affected Versions: git-url-parse versions 0.4.4 and earlier Description: The issue allows Regular Expression Denial of Service ReDos via a crafted URL to normalize url in lib.rs. This is similar to an issue found in Python. Recommendations: For versions 0.4.4 a...

PT-2023-20511

Name of the Vulnerable Software and Affected Versions dottie versions prior to 2.0.4 Description The issue is related to Prototype Pollution due to insufficient checks. It can be exploited via the set function and the current variable in the /dottie.js file. Recommendations For versions prior to...

PT-2023-23502 · Owncast · Owncast

Name of the Vulnerable Software and Affected Versions: owncast/owncast versions prior to 0.1.0 Description: The issue is related to Server-Side Request Forgery SSRF in the owncast/owncast GitHub repository. This allows an attacker to make requests to internal services that are not intended for...

PT-2023-22400 · Unknown · Facemoji Emoji Keyboard

Name of the Vulnerable Software and Affected Versions: Facemoji Emoji Keyboard version 2.9.1.2 Description: The issue allows unauthorized apps to cause escalation of privilege attacks by manipulating a component. Recommendations: For Facemoji Emoji Keyboard version 2.9.1.2, consider restricting...

PT-2023-25074 · Chamilo · Chamilo

Name of the Vulnerable Software and Affected Versions: Chamilo versions 1.11. up to 1.11.18 Description: The issue allows attackers to execute a Server-Side Request Forgery SSRF and obtain information on the services running on the server via crafted requests in the social and links tools...

PT-2023-24926 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 v4 version US AC10V4.0si V16.03.10.13 cn Description: A stack overflow issue was discovered via the parameter list at the "/goform/SetNetControlList" API endpoint. This issue affects the Tenda AC10 v4 router. Recommendations: For...

PT-2023-7362 · Docker · Play With Docker

Name of the Vulnerable Software and Affected Versions: Play With Docker versions prior to 0.0.2 Description: The issue is related to an insecure CAP SYS ADMIN privileged mode in Play With Docker, which is associated with inadequate access control. This can be exploited by a remote attacker to...

PT-2023-4246 · Sap · Sap Message Server

Name of the Vulnerable Software and Affected Versions: SAP Message Server versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT Description: The issue is related to the Access Control List ACL of the SAP Message...

CVE-2023-33958 Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation

notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The...

CVE-2023-33957

CVE-2023-33957 affects the Notation CLI (github.com/notaryproject/notation) and describes a denial-of-service risk: if a registry is compromised and signs many artifacts, a user running notation inspect/verify can exhaust host resources. The issue is mitigated by upgrading to v1.0.0-rc.6 or newer...

AlmaLinux 9 : cups-filters (ALSA-2023:3423)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:3423 advisory. - cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use t...

PT-2023-11511 · Unknown · Emlog Emlogcms

Name of the Vulnerable Software and Affected Versions: Emlog EmlogCMS version 6.0.0 Description: A remote attacker can gain access to sensitive information via the "/admin/plugin.php" function. This issue allows unauthorized access, potentially leading to data breaches. Recommendations: For Emlog...

PT-2023-10173 · WordPress · Broken Link Checker Plugin

Name of the Vulnerable Software and Affected Versions: Broken Link Checker Plugin versions up to 1.10.1 Description: A vulnerability was found in the Broken Link Checker Plugin. It affects the function options page of the file core/core.php of the component Settings Page. The manipulation of the...

PT-2023-16351 · WordPress · Hostel

Name of the Vulnerable Software and Affected Versions: Hostel WordPress plugin versions prior to 1.1.5.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

PT-2023-24859 · Unknown · Harbinger Offline Player

Name of the Vulnerable Software and Affected Versions: Harbinger Offline Player version 4.0.6.0.2 Description: The issue allows directory traversal as LocalSystem via .. in a URL. This can be exploited in OfflinePlayerService.exe. Recommendations: For Harbinger Offline Player version 4.0.6.0.2,...

PT-2023-19831 · WordPress · Stop Spammers Security

Name of the Vulnerable Software and Affected Versions: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin versions prior to 2023 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because various parameters are not properly...

PT-2023-19880 · 10Web · 10Web Social Post Feed

Name of the Vulnerable Software and Affected Versions: 10Web Social Post Feed WordPress plugin versions prior to 1.2.9 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because some parameters are not properly sanitised and escaped before being outputted bac...

PT-2023-24335 · Minical · Minical

Name of the Vulnerable Software and Affected Versions: Minical version 1.0.0 Description: The issue is related to Cross Site Request Forgery CSRF via the minical/public/application/controllers/settings/company.php file. This means an attacker could potentially trick a user into performing...