PT-2023-6979 · Unknown · Newsletters

Name of the Vulnerable Software and Affected Versions: Newsletter versions prior to 7.6.9 Description: The issue is a cross-site scripting vulnerability that allows a remote unauthenticated attacker to inject an arbitrary script. This can be exploited to conduct cross-site scripting attacks. The...

PT-2023-23299 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Central Management Service versions 420, 430 Description: The issue allows an attacker to access restricted information under certain conditions. Some users with specific privileges could hav...

PT-2025-25909 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.0-rc2-syzkaller-00316-g0457e5153e0e Description: A vulnerability in the Linux kernel has been resolved, related to the udmabuf device. If the DMA mask is not set explicitly, a warning occurs when userspace...

PT-2023-23355 · Gl.Inet · Gl.Inet

Name of the Vulnerable Software and Affected Versions: GL.iNet devices running firmware prior to 3.216 Description: An issue allows for arbitrary file write, enabling the creation of an empty file almost anywhere on the filesystem, given that the filename and path are no more than 6 characters. T...

PT-2025-18619 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A memory leak issue has been identified in the Linux kernel. The problem occurs when the device add disk function fails, causing memory allocated in wbt enable default to not be...

PT-2023-16687 · WordPress · Ai Chatbot

Name of the Vulnerable Software and Affected Versions: AI ChatBot WordPress plugin versions prior to 4.4.5 Description: The issue concerns the AI ChatBot WordPress plugin, which does not properly escape most of its settings before outputting them in the dashboard and lacks a proper CSRF check. Th...

PT-2023-18653 · Woocommerce · Chilidevs Return/Warranty Management System

Name of the Vulnerable Software and Affected Versions: chilidevs Return and Warranty Management System for WooCommerce plugin versions 1.2.3 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited without...

Input validation

Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3...

PT-2023-22545 · Unknown · Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: Online Food Ordering System version 2.0 Description: The issue allows attackers to execute arbitrary code via uploading a crafted PHP file, exploiting an arbitrary file upload vulnerability in the component "/admin/ajax.php?action=save menu"...

PT-2023-20140 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.2.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application receives input from a user and stores it, allowing an attacker to inject malicious scripts. This...

Security Bulletin: IBM Virtualization Engine TS7700 is vulnerable to a privilege escalation threat (CVE-2023-24958)

Summary IBM Virtualization Engine TS7700 is vulnerable to a privilege escalation threat CVE-2023-24958. IBM Virtualization Engine TS7700 has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-24958 DESCRIPTION: A vulnerability in the IBM TS7700 Management Interface could allow an...

Path traversal

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Carlo Gavazzi Powersoft up to version 2.1.1.1 allows an unauthenticated, remote attacker to download any file from the affected device...

PT-2023-23307 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana versions 8.0.0 through 8.7.0 Description: The issue is an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This...

PT-2023-22537 · Total.Js · Total.Js

Name of the Vulnerable Software and Affected Versions: TotalJS messenger version b6cf1c9 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the channel description field. This enables attackers to...

PT-2023-7445 · Canon · I-Sensys Mf640C Series +10

Name of the Vulnerable Software and Affected Versions: Canon imageCLASS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware versions prior to Ver.11.05 Canon imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware versions prior to...

PT-2023-19976 · Unknown · Caton Prime

Name of the Vulnerable Software and Affected Versions: Caton Prime version 2.1.2.51.e8d7225049202303031001 Description: A critical issue affects the Ping Handler component, specifically the file "cgi-bin/tools ping.cgi?action=Command", where manipulation of the Destination argument leads to comma...

PT-2023-18253 · Unknown · Mpos Tui Trustlet

Name of the Vulnerable Software and Affected Versions: mPOS TUI trustlet versions prior to SMR May-2023 Release 1 Description: The issue is an out-of-bounds write vulnerability in the TA Communication mpos encrypt pin function of the mPOS TUI trustlet. This allows local attackers to execute...

PT-2023-23308

Name of the Vulnerable Software and Affected Versions Kibana version 8.7.0 Description The issue is an arbitrary code execution flaw. An attacker with all privileges to the Uptime/Synthetics feature could send a request to execute JavaScript code, potentially leading to the execution of arbitrary...

PT-2023-20505 · Gin Gonic +1 · Gin +1

Name of the Vulnerable Software and Affected Versions: github.com/gin-gonic/gin versions prior to 1.9.0 Description: The issue is related to Improper Input Validation, allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning...

Input validation

An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with Fire...