PT-2023-26672 · Vtiger · Vtiger Crm

Name of the Vulnerable Software and Affected Versions: Vtiger CRM version 7.5.0 Description: A SQL injection issue allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRun.php. This enables the attacker to potentially gain higher access level...

PT-2023-27712 · Unknown · Schoolmate

Name of the Vulnerable Software and Affected Versions: Schoolmate version 1.3 Description: The issue concerns SQL Injection in the schoolname variable from the Database, located at header.php. This allows for potential exploitation. Recommendations: For Schoolmate version 1.3, consider restrictin...

PT-2023-27713 · Sourcecodester · Sourcecodester Doctors Appointment System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Doctor Appointment System version 1.0 Description: The issue concerns SQL Injection in the userid variable at the doctorsmyDetails.php endpoint. This allows for potential manipulation of database queries. Recommendations: For...

PT-2023-28714 · Unknown · Wpdatatables

Name of the Vulnerable Software and Affected Versions: wpDataTables versions prior to 2.1.66 Description: The issue concerns the deserialization of arbitrary data due to a lack of validation of the Serialized PHP array input data. This can potentially lead to remote code execution if a suitable...

PT-2023-23131 · Tsplus · Tsplus Remote Access

Name of the Vulnerable Software and Affected Versions: TSplus Remote Access versions through 16.0.2.14 Description: An issue was discovered in TSplus Remote Access where some directories under %PROGRAMFILESX86%TSplusUserDesktopthemes have Full Control permissions for Everyone. Recommendations: Fo...

PT-2023-4970

Name of the Vulnerable Software and Affected Versions ASUS RT-AX55 version 3.0.0.4.386.51598 Description The issue is related to an authenticated command injection vulnerability. This vulnerability allows a remote attacker to execute arbitrary system commands. Over 9,000 ASUS routers have been...

PT-2023-9201 · Tp Link · Tp-Link Omada Er605

Name of the Vulnerable Software and Affected Versions: TP-Link Omada ER605 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. The flaw exists within the handling of the...

Fails to prohibit standard library access prior to initialization of Rust standard library runtime

Affected versions allow arbitrary caller-provided code to execute before the lifetime of main. If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as std::io or std::thread, these may not behave as documented. Panics are...

PT-2023-30858 · Ibos Oa · Ibos Oa

Name of the Vulnerable Software and Affected Versions: IBOS OA version 4.5.5 Description: A critical issue has been found in the software, affecting some unknown functionality of the file ?r=file/dashboard/trash&op=del. The manipulation of the argument fids leads to SQL injection. The attack may ...

Code injection

IBM Aspera Faspex 5.0.5 does not restrict or incorrectly restricts access to a resource from an unauthorized actor. IBM X-Force ID: 246713...

CVE-2023-24965

CVE-2023-24965 affects IBM Aspera Faspex 5.0.5 (and earlier) and is due to improper access control that allows an unauthorized actor to access a resource. Multiple sources (IBM security bulletin and Red Hat/NVD records) confirm the issue and cite a remediation: upgrade to Faspex 5.0.6 to address ...

CVE-2023-41338

Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could...

CVE-2023-41338 Vulnerability in Ctx.IsFromLocal() in gofiber

Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could...

CVE-2023-41338 Vulnerability in Ctx.IsFromLocal() in gofiber

Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could...

GHSA-3Q5P-3558-364F Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`

Impact This vulnerability can be categorized as a security misconfiguration. It impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. In it's...

CVE-2023-41775

Improper access control vulnerability in 'direct' Desktop App for macOS ver 2.6.0 and earlier allows a local attacker to bypass access restriction and to use camrea, microphone, etc. of the device where the product is installed without the user's consent...

PT-2023-19845 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex version 5.0.5 Description: The issue is related to incorrect access restriction to a resource from an unauthorized actor. There is no information provided about the estimated number of potentially affected devices worldwide ...

PT-2023-30848 · Pegasystems · Pega Platform

Name of the Vulnerable Software and Affected Versions: Pega Platform versions 7.1 to 8.8.3 Description: The issue is an HTML Injection problem with a name field used in Visual Business Director. This field can only be modified by an authenticated administrative user. Recommendations: For Pega...

PT-2023-26777 · General Motors · Chevrolet Equinox

Name of the Vulnerable Software and Affected Versions: General Motors GM Chevrolet Equinox 2021 Software version 2021.03.26 Description: Injecting random data into the USB memory area causes a Denial of Service DoS in the in-car infotainment system. Recommendations: For General Motors GM Chevrole...

PT-2023-28303 · Unknown · Jeecg-Boot

Name of the Vulnerable Software and Affected Versions: Jeecg boot versions up to 3.5.3 Description: A SQL injection vulnerability was discovered in Jeecg boot via the component "/jeecg-boot/jmreport/show". This issue allows for SQL injection attacks, potentially leading to unauthorized access to...