Medium: golang

Issue Overview: 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192...

PT-2023-29240 · Sourcecodester · Sourcecodester Free Hospital Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Free Hospital Management System for Small Practices version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file vmpatientedit-user.php. The manipulation of the argument...

PT-2023-5206 · Fortinet · Fortitester

Name of the Vulnerable Software and Affected Versions: FortiTester versions 2.3.0 through 7.2.3 Description: A use of hard-coded credentials issue in FortiTester may allow an attacker who has gained shell access to the device to access the database via shell commands. This could potentially lead ...

PT-2023-27104

Name of the Vulnerable Software and Affected Versions Tenda AC8V4 version 16.03.34.06 Description A stack overflow issue was discovered via the list parameter in the save virtualser data function. This issue may be exploited, potentially leading to unintended consequences. Recommendations For Ten...

PT-2023-27106

Name of the Vulnerable Software and Affected Versions Tenda AC8V4 version 16.03.34.06 Description A stack overflow issue was discovered via the time parameter in the sscanf function. Recommendations For Tenda AC8V4 version 16.03.34.06, consider restricting access to the sscanf function until a...

PT-2023-8186 · Mikrotik · Routeros +1

Name of the Vulnerable Software and Affected Versions: MikroTik RouterOS versions 7.1 through 7.11 Description: The issue is related to incorrect access control mechanisms in place for the Rest API, which can allow a remote attacker to disclose protected information. Recommendations: For versions...

PT-2023-21218 · Phplist · Phplist

Name of the Vulnerable Software and Affected Versions: phpList versions prior to 3.6.14 Description: An issue was discovered due to an access error, allowing manipulation and editing of the system's super admin data, which enables an account takeover of the user with super-admin permission...

PT-2023-26621 · Unknown · Kidus Minimati

Name of the Vulnerable Software and Affected Versions: Kidus Minimati version 1.0.0 Description: A SQL injection issue allows a remote attacker to obtain sensitive information via the ID parameter in the "fulldelete.php" component. Recommendations: For Kidus Minimati version 1.0.0, as a temporary...

PT-2023-29206 · Cockpit · Cockpit

Name of the Vulnerable Software and Affected Versions: cockpit versions prior to 2.6.4 Description: The issue is related to Cross-site Scripting XSS - Reflected in the GitHub repository cockpit-hq/cockpit. This type of attack occurs when an application includes user input in its response without...

PT-2023-29092 · Unknown · Nbs&Happysoftwechat

Name of the Vulnerable Software and Affected Versions: NBS&HappySoftWeChat version 1.1.6 Description: A critical issue has been found in the software, affecting some unknown functionality. This issue leads to unrestricted upload and can be exploited remotely. The exploit has been disclosed to the...

The vulnerability of the VulnDownloader class in the Network Configuration Manager (NCM) software allows a hacker to execute arbitrary code.

The vulnerability of the VulnDownloader class in the Network Configuration Manager NCM software is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the SYSTEM context remotely...

PT-2023-26939 · Proself · Proself Mail Sanitize Edition +2

Name of the Vulnerable Software and Affected Versions: Proself Enterprise/Standard Edition versions 5.61 and earlier Proself Gateway Edition versions 1.62 and earlier Proself Mail Sanitize Edition versions 1.07 and earlier Description: The issue allows a remote unauthenticated attacker to log in ...

PT-2023-5744 · WordPress · Comments Like Dislike

Name of the Vulnerable Software and Affected Versions: Comments Like Dislike plugin for WordPress versions up to, and including, 1.1.9 Description: The issue is related to a missing capability check on the restore settings function, which can be exploited via an AJAX action. This allows...

PT-2023-26620 · Unknown · Kidus Minimati

Name of the Vulnerable Software and Affected Versions: Kidus Minimati version 1.0.0 Description: The issue allows a remote attacker to obtain sensitive information via the "edit.php" component. This is due to a SQL injection vulnerability. Recommendations: For Kidus Minimati version 1.0.0, consid...

PT-2023-27063 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version US AC6V1.0BR V15.03.05.16 Description: A buffer overflow issue was discovered via the function fgets. Recommendations: For Tenda AC6 version US AC6V1.0BR V15.03.05.16, consider restricting access to the function fgets until ...

PT-2023-4621 · Unknown · Tn-5900 Series

Name of the Vulnerable Software and Affected Versions: TN-5900 Series firmware versions v3.3 and prior Description: The issue stems from insufficient input validation and improper authentication in the key-generation function. This could potentially allow malicious users to execute remote code on...

PT-2023-6517 · Dell · Dell Storage Integration Tools For Vmware +2

Name of the Vulnerable Software and Affected Versions: Dell Storage Integration Tools for VMware DSITV versions prior to 6.1.1 Dell Storage vSphere Client Plugin DSVCP versions prior to 6.1.1 Replay Manager for VMware RMSV versions prior to 3.1.2 Description: The issue is related to an informatio...

PT-2023-27402 · Jenkins · Jenkins Delphix Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Delphix Plugin versions 3.0.2 and earlier Description: A missing permission check in the Jenkins Delphix Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This can be...

Multiple vulnerabilities in ELECOM and LOGITEC network devices

Overview Multiple network devices provided by ELECOM CO.,LTD. and LOGITEC CORPORATION contain multiple vulnerabilities listed below. Hidden Functionality CWE-912 - CVE-2023-32626, CVE-2023-35991, CVE-2023-39445 Telnet service access restriction failure CWE-284 - CVE-2023-38132 Hidden Functionalit...

PT-2023-27135 · Webchess · Webchess

Name of the Vulnerable Software and Affected Versions: webchess version 1.0 Description: A SQL injection issue was discovered in webchess via the $playerID parameter at the "mainmenu.php" endpoint. However, it is disputed by a third party who claims that the $playerID is a session variable...