PT-2023-30693 · Unknown · Xxl-Job-Admin

Name of the Vulnerable Software and Affected Versions: xxl-job-admin version 2.4.0 Description: The issue concerns insecure permissions in xxl-job-admin, specifically affecting the "/xxl-job-admin/joblog/clearLog" and "/xxl-job-admin/joblog/logDetailCat" API endpoints. Recommendations: For...

PT-2023-30729 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: PublicCMS version 4.0.202302.e Description: The issue allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the "api/method/getHtml" component. Recommendations: For PublicCMS version 4.0.202302....

CVE-2023-45582

An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to perform a brute force attack on the affected endpoints via repeated login attempts...

WordPress Plugin YOP Poll Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2023-29807 · Unknown · Phpgurukul Teacher Subject Allocation Management System

Name of the Vulnerable Software and Affected Versions: phpgurukul Teacher Subject Allocation Management System version 1.0 Description: The issue allows attackers to obtain sensitive information. It involves a SQL Injection vulnerability in the teacher-info.php file, where the editid parameter is...

PT-2023-14014 · Intel · Intel In-Band Manageability

Name of the Vulnerable Software and Affected Versions: Intel In-Band Manageability software versions prior to 3.0.14 Description: The issue is related to improper access control, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations:...

PT-2023-29808 · Unknown · Phpgurukul Teacher Subject Allocation Management System

Name of the Vulnerable Software and Affected Versions: phpgurukul Teacher Subject Allocation Management System version 1.0 Description: The issue concerns a Cross Site Scripting XSS vulnerability. This vulnerability allows attackers to run arbitrary code via the adminname and email parameters in...

Siemens COMOS

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2023-30668 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was found in Dreamer CMS. The issue is related to the "/admin/task/changeStatus" API endpoint. Recommendations: For Dreamer CMS version 4.1.3, as a temporary...

PT-2023-6998 · Siemens · Simatic Pcs Neo

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo versions prior to V4.1 Description: The issue is related to a lack of authentication for a critical function in the administrative console of the SIMATIC PCS neo web system management technology process. This could allow a...

PT-2023-30696

Name of the Vulnerable Software and Affected Versions CesiumJS version 1.111 Description A cross-site scripting XSS vulnerability allows attackers to execute arbitrary code in the context of the victim's browser via sending a crafted payload to "/container files/public html/doc/index.html". The...

PT-2023-29743 · Gibbon · Gibbon

Name of the Vulnerable Software and Affected Versions: GibbonEdu Gibbon versions through 25.0.0 Description: The issue allows file upload with resultant XSS through the /modules/Planner/resources addQuick ajaxProcess.php file. The imageAsLinks parameter must be set to 'Y' to return HTML code. The...

EnBw SENEC Legacy Storage Box Exposed Interface

Advisory ID: Ph0s-2023-005 Product: EnBw - SENEC legacy storage box: V1-V3 Manufacturer: SENEC - a part of EnBw Affected Versions: Firmware: all as of 2023-06-19 Tested Versions: current Vulnerability Type: CWE-923: Improper Restriction of Communication Channel to Intended Endpoints Risk Level:...

PT-2023-8110 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti version 1.2.25 Description: The issue is related to insufficient protection of the web page structure in the Cacti network monitoring tool. This allows a remote attacker to conduct cross-site scripting attacks and gain unauthorized acce...

PT-2023-30439 · Headscale · Headscale

Name of the Vulnerable Software and Affected Versions: Headscale versions through 0.22.3 Description: The issue allows Headscale to write bearer tokens to info-level logs. Recommendations: For versions through 0.22.3, consider restricting log access to minimize the risk of exploitation. At the...

The vulnerability of the /api/upload component of the software platform zdir, which allows a perpetrator to execute arbitrary code.

The vulnerability of the /api/upload component in the zdir application exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code using a specially created .ssh fil...

The vulnerability of the auth_start_session() function on the XRDP server allows a hacker to trigger a service failure.

The vulnerability of the authstartsession function on the XRDP server relates to bypassing session restrictions. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2023-23603 · Criss Swaim · Tpg Redirect Plugin

Name of the Vulnerable Software and Affected Versions: Criss Swaim TPG Redirect plugin versions 1.0.7 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions ...

PT-2023-30435 · Unknown · Dragon Family Line

Name of the Vulnerable Software and Affected Versions: DRAGON FAMILY Line version 13.6.1 Description: The issue allows remote attackers to send malicious notifications to victims due to the leakage of channel access token. Recommendations: For version 13.6.1, consider restricting access to the...

PT-2023-30428 · Unknown · Craft Members

Name of the Vulnerable Software and Affected Versions: craft members version 13.6.1 Description: The issue allows remote attackers to send malicious notifications to victims due to the leakage of channel access token. Recommendations: For version 13.6.1, consider restricting access to the craft...