CVE-2023-21369

In Usage Access, there is a possible way to display a Settings usage access restriction toggle screen due to a permissions bypass. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2023-21388

In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21388

CVE-2023-21388 affects Google Android, specifically the Settings component, where a missing permission check can enable a local escalation of privilege without extra execution privileges or user interaction. The vulnerability is categorized as EoP with a high impact on confidentiality, integrity,...

CVE-2023-21388

In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21377

In SELinux Policy, there is a possible restriction bypass due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21377

CVE-2023-21377 : Concrete information shows a local information disclosure via a restriction bypass in the Android SELinux Policy. The issue is triggered by a permissions bypass within the policy, allowing disclosure without extra execution privileges and without user interaction. Exploitation st...

The vulnerability of the handleFileRequest function in the src/main/java/com/feihong/ldap/HTTPServer.java file, a tool for exploiting vulnerabilities in Java Naming and Directory Interface (JNDI) via JNDIExploit, is related to a flaw in the pathname restriction mechanism. This vulnerability allows an attacker to disclose sensitive information that should be protected.

The vulnerability of the handleFileRequest function in src/main/java/com/feihong/ldap/HTTPServer.java of the JNDI exploitation tool is related to vulnerabilities in pathname restrictions. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

PT-2023-18163 · Settings · Settings

Name of the Vulnerable Software and Affected Versions: Settings affected versions not specified Description: The issue is related to a missing permission check in Settings, allowing for a possible restriction bypass. This could lead to local escalation of privilege with no additional execution...

PT-2023-31866 · WordPress · Bellows Accordion Menu

Name of the Vulnerable Software and Affected Versions: The Bellows Accordion Menu plugin for WordPress versions up to, and including, 1.4.2 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied...

PT-2023-31906 · WordPress · Php To Page

Name of the Vulnerable Software and Affected Versions: PHP to Page plugin for WordPress versions up to, and including, 0.3 Description: The issue allows authenticated attackers with subscriber-level permissions or above to include local files and potentially execute code on the server via the...

PT-2023-29230 · Unknown · Cloudexplorer Lite

Name of the Vulnerable Software and Affected Versions: CloudExplorer Lite versions prior to 1.4.1 Description: The issue concerns a permission bypass in CloudExplorer Lite, an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter uses a controller with a...

PT-2023-18152 · Unknown · Selinux-Policy

Name of the Vulnerable Software and Affected Versions: SELinux Policy affected versions not specified Description: In SELinux Policy, there is a possible restriction bypass due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed...

HestiaCP Security Vulnerabilities

HestiaCP is a lightweight and powerful control panel for modern networks. A security vulnerability exists in HestiaCP versions prior to 1.8.9, which stems from an insufficient privilege restriction issue...

The vulnerability of the Lightdash data visualization and analysis tool lies in the improper restriction of the path name to the restricted access catalog, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Lightdash data visualization and analysis tool is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

PT-2023-29893 · Unknown · Internet Marketing Ninjas Internal Link Building Plugin

Name of the Vulnerable Software and Affected Versions: Internet Marketing Ninjas Internal Link Building plugin versions 1.2.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability...

PT-2023-29881 · Unknown · Userfeedback Team User Feedback

Name of the Vulnerable Software and Affected Versions: UserFeedback Team User Feedback plugin versions 1.0.9 and earlier Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website, which...

PT-2023-30062 · Pwncyn · Yxbookcms

Name of the Vulnerable Software and Affected Versions: PwnCYN YXBOOKCMS version 1.0.2 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via the reader management and book input modules. Recommendations: For version 1.0.2, update to a newer version th...

PT-2023-28148 · Unknown · Flyteadmin

Name of the Vulnerable Software and Affected Versions: FlyteAdmin versions prior to 1.1.124 Description: The issue concerns a SQL vulnerability in list endpoints on FlyteAdmin, where a malicious user can send a REST request with custom SQL statements as list filters. This requires the attacker to...

PT-2023-29905 · Stylemixthemes · Stylemixthemes Motors – Car Dealer

Name of the Vulnerable Software and Affected Versions: StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin versions 1.4.6 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into t...

PT-2023-32109

Name of the Vulnerable Software and Affected Versions EDM Informatics E-invoice versions prior to 2.1 Description The issue is related to improper protection for outbound error messages and alert signals, allowing account footprinting. This can potentially reveal sensitive information about user...