Design/Logic Flaw

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the timescaledb feature of Juniper Networks Paragon Active Assurance PAA Formerly Netrounds allows an attacker to bypass existing firewall rules and limitations used to restrict internal communcations. The Tes...

CVE-2023-28971 Paragon Active Assurance: Enabling the timescaledb enables IP forwarding

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the timescaledb feature of Juniper Networks Paragon Active Assurance PAA Formerly Netrounds allows an attacker to bypass existing firewall rules and limitations used to restrict internal communcations. The Tes...

Access Restriction Bypass

Overview Oracle.ManagedDataAccess is a 100% native code .NET Framework driver for Oracle Database Affected versions of this package are vulnerable to Access Restriction Bypass via the TCPS protocol, that allows component takeover. Remediation Upgrade Oracle.ManagedDataAccess to version 19.18.0,...

PT-2023-13659 · Linksys · Linksys Ax3200

Name of the Vulnerable Software and Affected Versions: Linksys AX3200 version 1.1.00 Description: The issue allows OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page. Recommendations: For Linksys AX3200 version 1.1.00, consider restricting acce...

PT-2023-12239 · Liferay · Liferay Portal

Name of the Vulnerable Software and Affected Versions: Liferay Portal version 6.2.5 Description: The issue allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. The vendor disputes this issue because the exploit reference link only shows frmfolders.html is...

PT-2023-12939 · Mybb · External Redirect Warning Plugin

Name of the Vulnerable Software and Affected Versions: External Redirect Warning Plugin version 1.3 for MyBB Description: The issue concerns a problem where the redirect URL, also known as external.php?url=, is susceptible to XSS. This means an attacker could potentially inject malicious scripts...

PT-2023-17757 · Sourcecodester · Sourcecodester Vehicle Service Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Vehicle Service Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file /classes/Master.php. The manipulation of the id argument leads to sql...

CVE-2022-2525 Improper Restriction of Excessive Authentication Attempts in janeczku/calibre-web

Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20...

PT-2023-17820 · Unknown · Easyappointments

Name of the Vulnerable Software and Affected Versions: alextselegidis/easyappointments versions prior to 1.5.0 Description: The issue is related to stored Cross-site Scripting XSS in the GitHub repository alextselegidis/easyappointments. A patch is available, and it is anticipated to be part of...

CVE-2022-2525 Improper Restriction of Excessive Authentication Attempts in janeczku/calibre-web

Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20...

PT-2023-2749 · D Link · D-Link Dir 819

Name of the Vulnerable Software and Affected Versions: D-Link DIR-819 version 1.06 Description: The issue is related to incorrect resource cleanup, allowing a remote attacker to trigger a Denial of Service via a specially crafted request to the "cgi-bin/webproc?getpage=html/index.html" endpoint...

CVE-2023-29529

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker...

Open redirect

The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on open-feature-operator-controller-manager to escalate the privileges o...

CVE-2023-29529 matrix-js-sdk vulnerable to invisible eavesdropping in group calls

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker...

Security Bulletin: Vulnerabilities in GNU C library (glibc) affect IBM BladeCenter Advanced Management Module (AMM) (CVE-2015-7547 CVE-2015-8776 CVE-2015-8777)

Summary Vulnerabilities in GNU C library glibc, including a stack-based buffer overflow in getaddrinfo, affect IBM BladeCenter Advanced Management Module AMM. Vulnerability Details Summary Vulnerabilities in GNU C library glibc, including a stack-based buffer overflow in getaddrinfo, affect IBM...

PT-2023-21291 · Unknown · Auto Dealer Management System

Name of the Vulnerable Software and Affected Versions: Auto Dealer Management System version 1.0 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the name parameter at the "/classes/SystemSettings.php?f=update settings" API...

PT-2023-14628 · Unknown · Livebox Collaboration Vdesk

Name of the Vulnerable Software and Affected Versions: LIVEBOX Collaboration vDesk versions vDesk through v018 Description: An issue allows a Bypass of Two-Factor Authentication under the "/api/v1/vdeskintegration/challenge" endpoint. Since only the client-side verifies whether a check was...

PT-2023-22443 · Aerocms · Aerocms

Name of the Vulnerable Software and Affected Versions: AeroCMS version 0.0.1 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload, exploiting multiple stored cross-site scripting XSS vulnerabilities. These vulnerabilities are accessible via the...

PT-2023-3156 · Totolink · Totolink X18

Name of the Vulnerable Software and Affected Versions: TOTOLINK X18 version V9.1.0cu.2024 B20220329 Description: The issue is related to insufficient argument validation in the UploadFirmwareFile function of the TOTOLINK X18 router's firmware, allowing a remote attacker to execute arbitrary...

PT-2023-7825 · Totolink · Totolink X18

Name of the Vulnerable Software and Affected Versions: TOTOLINK X18 version 9.1.0cu.2024 B20220329 Description: The issue is related to a command injection vulnerability in the disconnectVPN function, specifically via the pid parameter. This vulnerability is due to insufficient argument checking,...