PT-2023-25542 · Unknown · Pos Codekop

Name of the Vulnerable Software and Affected Versions: POS Codekop version 2.0 Description: A Cross-Site Request Forgery CSRF issue allows attackers to escalate privileges. Recommendations: For POS Codekop version 2.0, consider implementing proper CSRF token validation to prevent unauthorized...

PT-2023-25512 · Webkul · Webkul Qloapps

Name of the Vulnerable Software and Affected Versions: Webkul QloApps version 1.6.0 Description: An unauthenticated Cross-Site Scripting XSS issue allows an attacker to obtain a user's session cookie, which can then be used to impersonate the user. This is achieved via the POST controller...

PT-2023-5205 · Fortinet · Fortisiem

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSIEM versions 6.7.0 through 6.7.5 Description: The issue is related to insufficient protection of service data in the security management system, allowing an attacker to disclose sensitive information via crafted HTTP requests...

PT-2023-23347 · Apache · Apache Streampipes

Name of the Vulnerable Software and Affected Versions: Apache StreamPipes versions 0.69.0 through 0.91.0 Description: A REST interface in Apache StreamPipes was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond th...

Security Bulletin: IBM MQ is affected by vulnerabilities in libcURL (CVE-2023-23916, CVE-2023-27535)

Summary Multiple issues were identified within the libcurl library that affect IBM MQ. IBM MQ uses libcurl to provide HTTPURL functionality which is only used to download remote CCDT files and is not used to send or receive messages. Vulnerability Details CVEID:CVE-2023-23916 DESCRIPTION: cURL...

SUSE CVE-2023-30583

fs.openAsBlob can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob API. Please note that at the time this CVE was issued, the permission model is an...

PT-2023-22363 · Gbcom · Gbcom Lac Web Control Center

Name of the Vulnerable Software and Affected Versions: GBCOM LAC WEB Control Center version lac-1.3.x Description: The issue allows attackers to create an arbitrary device through a Cross Site Scripting XSS vulnerability. Recommendations: For GBCOM LAC WEB Control Center version lac-1.3.x, consid...

Node.js 16.x < 16.20.1 / 18.x < 18.16.1 / 20.x < 20.3.1 Multiple Vulnerabilities (Tuesday June 20 2023 Security Releases).

The version of Node.js installed on the remote host is prior to 16.20.1, 18.16.1, 20.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Tuesday June 20 2023 Security Releases advisory. - The use of proto in process.mainModule.proto.require can bypass the policy...

PT-2023-3650 · Unknown · Spidercontrol Scada Web Server

Name of the Vulnerable Software and Affected Versions: SpiderControl SCADA Webserver versions 2.08 and prior Description: The issue exists due to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may allow a remote attacker to cause a...

PT-2023-20941 · Pluck Cms · Pluck Cms

Name of the Vulnerable Software and Affected Versions: Pluck CMS versions 4.7.15 through 4.7.16-dev5 Description: A remote code execution issue was found in the /admin.php file of Pluck CMS, allowing attackers to execute arbitrary code through the manage file functionality. Recommendations: For...

PT-2023-21482 · Hcl · Hcl Bigfix Osd Bare Metal Server

Name of the Vulnerable Software and Affected Versions: HCL BigFix OSD Bare Metal Server versions 311.12 or lower Description: The issue allows an attacker to supply invalid input, causing the server to perform a redirect to an attacker-controlled domain. This is achieved through a Host Header...

PT-2023-25003 · Sliver · Sliver

Name of the Vulnerable Software and Affected Versions: Sliver versions 1.5.x through 1.5.39 Description: The issue is related to an improper cryptographic implementation, allowing attackers to execute a man-in-the-middle attack via intercepted and crafted responses. This enables attackers to...

PT-2023-18600 · Suse · Suse Manager Server Module +1

Name of the Vulnerable Software and Affected Versions: SUSE Manager Server Module 4.2 versions prior to 4.2.50-150300.3.66.5 SUSE Manager Server Module 4.3 versions prior to 4.3.58-150400.3.46.4 NeuVector affected versions not specified Description: A user can reverse engineer the JSON Web Token...

CLSA-2023-1687269849 openssl: Fix of CVE-2023-2650

CVE-2023-2650: Restrict the size of OBJECT IDENTIFIERs that OBJobj2txt will translate - Update expired smime/SM2 certificates that affect tests...

CLSA-2023-1687268961 openssl: Fix of CVE-2023-2650

CVE-2023-2650: Restrict the size of OBJECT IDENTIFIERs that OBJobj2txt will translate - Update expired smime/SM2 certificates that affect tests...

CVE-2023-26436

Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processin...

The vulnerability of operating systems for network storage devices My Cloud OS, cloud storage services My Cloud Home and My Cloud Home Duo, as well as SanDisk iBI, stems from incorrect path name restrictions for access-controlled directories. This allows attackers to execute arbitrary code.

The vulnerability of the My Cloud OS, the cloud storage services My Cloud Home and My Cloud Home Duo, as well as the SanDisk iBeacon, is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability could allow a remote attacker to execute arbitrar...

PT-2023-24196 · Unknown · Sourcecodester Record Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Resort Management System version 1.0 Description: A vulnerability was found in the system, declared as problematic, affecting an unknown functionality. The manipulation of the page argument leads to cross-site scripting. The...

PT-2023-21181 · WordPress · Upload Resume Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Upload Resume WordPress plugin versions 1.2.0 and earlier Description: The issue allows unauthenticated visitors to upload arbitrary media files to the site due to a lack of validation of the captcha parameter when uploading a resume via the...

PT-2023-4128 · Abb · Abb Ability Zenon

Name of the Vulnerable Software and Affected Versions: ABB Ability zenon versions 11 build through 11 build 106404 Description: A vulnerability exists in the zenon system, allowing low-privileged users to read and update data in various directories. This issue can be exploited by attackers using...