PT-2023-30008 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.652 B20230116 Description: A command execution issue was discovered via the sub 416F60 function, allowing for potential exploitation. Recommendations: For TOTOLINK X6000R version 9.4.0cu.652 B20230116, consider...

CVE-2023-5717

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events perf component can be exploited to achieve local privilege escalation. If perfreadgroup is called while an event's siblinglist is smaller than its child's siblinglist, it can increment or write to memor...

PT-2023-8180 · Abo.Cms · Abo.Cms

Name of the Vulnerable Software and Affected Versions: ABO.CMS version 5.9.3 Description: The issue is related to a SQL Injection vulnerability in the Documents module of ABO.CMS, which allows remote attackers to execute arbitrary code via the d parameter. This vulnerability is due to the lack of...

The vulnerability of the SolarWinds Access Rights Manager software lies in the incorrect restriction of the path name to the restricted directory. This allows a violator to execute arbitrary code.

The vulnerability of the SolarWinds Access Rights Manager software relates to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

PT-2023-21033 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue is related to an unauthenticated SQL injection in the GetRoomChanges method, allowing unauthenticated attackers to extract or modify all data. Recommendations: For versions...

PT-2023-30001 · Audimex · Audimex

Name of the Vulnerable Software and Affected Versions: Audimex version 15.0.0 Description: The issue concerns Cross Site Scripting XSS in the /audimex/cgi-bin/wal.fcgi endpoint via the company parameter in search filters. Recommendations: For Audimex version 15.0.0, as a temporary workaround,...

PT-2023-30151 · Elastic · Fleet Server

Name of the Vulnerable Software and Affected Versions: Fleet Server versions 8.10.0 through 8.10.2 Description: An issue was discovered where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into...

PT-2023-20744 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application version 3.1.013 Description: The issue allows authenticated attackers to upload arbitrary files to the web root, including dangerous files such as ASP or ASPX, which can lead to command execution on the affected server...

AccountingEngine can only transfer a maximum of 1% of the surplus to the designated extraSurplusReceiver

Lines of code Vulnerability details Impact The impact of this vulnerability is related to the validation of the surplus transfer percentage in the AccountingEngine contract. The vulnerability arises from an incorrect validation check that restricts the surplus transfer percentage to WAD 1%. Proof...

The vulnerability of the SolarWinds Access Rights Manager software lies in the incorrect restriction of the path name to the restricted directory. This allows a violator to execute arbitrary code.

The vulnerability of the SolarWinds Access Rights Manager software relates to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

PT-2023-30103 · Weborf +1 · Weborf +1

Name of the Vulnerable Software and Affected Versions: Weborf versions 0.17 through 0.20 Itworf versions prior to 88 Description: The issue is related to a null termination flaw in the cgi.c file of Weborf, where the path for CGI scripts lacks '0' termination due to the misuse of strncpy. This...

PT-2023-29821 · WordPress · Osmansorkar Ajax Archive Calendar Plugin

Name of the Vulnerable Software and Affected Versions: Osmansorkar Ajax Archive Calendar plugin versions = 2.6.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher privileges. There is no...

PT-2023-29666 · Unknown · Posimyth Nexter Extension

Name of the Vulnerable Software and Affected Versions: POSIMYTH Nexter Extension plugin versions = 2.0.3 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into a website, potentially leading to...

PT-2023-29817 · Lenovo · Thinksystem

Name of the Vulnerable Software and Affected Versions: ThinkSystem versions v2 and v3 Description: An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This issue affects ThinkSystem servers with XCC. Recommendations: For...

PT-2023-29858

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.22.1 Description The Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The configuration data is filtered to suppress most sensitive configuration information before ...

PT-2023-29820 · Xqueue Gmbh · Maileon

Name of the Vulnerable Software and Affected Versions: XQueue GmbH Maileon for WordPress plugin versions = 2.16.0 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject malicious...

PT-2023-29831 · Lenovo · Thinksystem

Name of the Vulnerable Software and Affected Versions: ThinkSystem versions v2 and v3 Description: An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. Recommendations: For ThinkSystem versions v2 and v3, consider...

PT-2023-32300 · Synology · Synology Camera Firmware

Name of the Vulnerable Software and Affected Versions: Synology Camera Firmware versions prior to 1.0.5-0185 Description: A vulnerability regarding the use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified...

PT-2023-32298 · WordPress · The Very Simple Google Maps

Name of the Vulnerable Software and Affected Versions: The Very Simple Google Maps plugin for WordPress versions up to, and including, 2.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'vsgmap' shortcode due to insufficient input sanitization and output escapin...

PT-2023-28684 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity version 5.3 Description: A remote unauthenticated attacker could potentially exploit this vulnerability by crafting arbitrary files through a request to the server. The issue is related to an Arbitrary File Creation vulnerability...