PT-2023-26357 · Unknown · Bug Finder Wedding Wonders

Name of the Vulnerable Software and Affected Versions: Bug Finder Wedding Wonders version 1.0 Description: A vulnerability was found in the Ticket Handler component, specifically in the /user/ticket/create file, where an unknown function is affected. The manipulation of the message argument leads...

PT-2023-6727 · Dahua · Dahua Smart Parking Management

Name of the Vulnerable Software and Affected Versions: Dahua Smart Park Management versions up to 20230713 Description: The issue is related to an unrestricted file upload vulnerability in the /emap/devicePoint addImgIco?hasSubsystem=true file, which can be exploited remotely. This vulnerability...

PT-2023-26271 · Sourcecodester · Sourcecodester House Rental/Property Listing

Name of the Vulnerable Software and Affected Versions: SourceCodester House Rental and Property Listing System version 1.0 Description: A critical vulnerability was found in the system, affecting an unknown function of the file btn functions.php. This issue leads to unrestricted upload and can be...

PT-2023-26185 · Dapr · Dapr

Name of the Vulnerable Software and Affected Versions: Dapr versions prior to 1.10.9 Dapr versions prior to 1.11.2 Description: A vulnerability has been found in Dapr that allows bypassing API token authentication with a well-crafted HTTP request. This issue impacts Dapr users who have configured...

CVE-2023-32265

A potential security vulnerability has been identified in the Enterprise Server Common Web Administration ESCWA component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server. An attacker would need to be authenticated into ESCWA to attempt to...

CVE-2023-32265

Summary (CVE-2023-32265): The vulnerability affects the Enterprise Server Common Web Administration (ESCWA) component used across Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server. An authenticated ESCWA user could exploit conditions described in the ...

The vulnerability of the SpiderControl SCADA Web Server arises from an incorrect restriction on the path to the restricted access catalog. This allows a intruder to cause a service failure.

The vulnerability of the SpiderControl SCADA Web Server exists due to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2023-26038 · Unknown · Office Suite Premium

Name of the Vulnerable Software and Affected Versions: Office Suite Premium Version v10.9.1.42602 Description: A reflected cross-site scripting XSS issue was found, which can be exploited via the id parameter at the "/api?path=profile" API endpoint. Recommendations: For Office Suite Premium Versi...

PT-2023-25813 · Unknown · Diafan Cms

Name of the Vulnerable Software and Affected Versions: Diafan CMS version 6.0 Description: The issue is related to a reflected cross-site scripting vulnerability. It occurs via the cat id parameter at the "/shop/?module=shop&action=search" API endpoint. Recommendations: For Diafan CMS version 6.0...

PT-2023-26056 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: eyoucms version 1.6.3 Description: The issue is related to an information disclosure vulnerability. It is exploited via the "/custom model path/recruit.filelist.txt" component. Recommendations: For eyoucms version 1.6.3, consider restricting...

PT-2023-26189 · Unknown · Bug Finder Chaincity Real Estate Investment Platform

Name of the Vulnerable Software and Affected Versions: Bug Finder ChainCity Real Estate Investment Platform version 1.0 Description: A problematic vulnerability has been found in the New Ticket Handler component of the Bug Finder ChainCity Real Estate Investment Platform. The issue affects an...

PT-2023-26060 · Unknown · Cockpit Cms

Name of the Vulnerable Software and Affected Versions: Cockpit CMS version 2.5.2 Description: A Cross-Site Request Forgery CSRF in the Admin portal allows attackers to execute arbitrary Administrator commands. Recommendations: For Cockpit CMS version 2.5.2, consider disabling access to the Admin...

CVE-2023-32657 Weintek Weincloud Improper Restriction of Excessive Authentication Attempts

Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses...

CVE-2023-32657 Weintek Weincloud Improper Restriction of Excessive Authentication Attempts

Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses...

PT-2023-26009 · Unknown · Creativeitem Mastery Lms

Name of the Vulnerable Software and Affected Versions: Creativeitem Mastery LMS version 1.2 Description: A problematic vulnerability has been found in Creativeitem Mastery LMS. This issue affects an unknown part of the file /browse. The manipulation of the argument search/featured/recommended/ski...

PT-2023-3875

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 6.49.7 MikroTik RouterOS long-term versions prior to 6.48.7 Description The issue is related to a privilege escalation problem in the Winbox and HTTP interfaces of MikroTik RouterOS. A remote and authenticat...

PT-2023-7027 · Unknown · Intergard Sgs

Name of the Vulnerable Software and Affected Versions: Intergard SGS version 8.7.0 Description: The issue is related to the transmission of sensitive information in cleartext due to a vulnerability in the SQL Query Handler component. This can be exploited remotely, potentially allowing an attacke...

CVE-2023-37259 Cross site scripting in Export Chat feature

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting XSS. Since the Export Chat feature...

Security Bulletin: Vulnerabilities in httpclient library affects IBM Engineering Test Management (ETM) (CVE-2020-13956)

Summary This Security Vulnerablity has been addressed in IBM Engineering Test Management. A fix is available to address the vulnerability. Vulnerability Details CVEID:CVE-2020-13956 DESCRIPTION: Apache HttpClient could allow a remote attacker to bypass security restrictions, caused by the imprope...

PT-2023-3697 · Oracle · Application Express Administration

Name of the Vulnerable Software and Affected Versions: Application Express Administration versions 18.2 through 22.2 Description: The issue is related to insufficient input validation in the Application Express Administration product of Oracle Application Express. It allows an unauthenticated...