PT-2023-17436 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: novel-plus version 3.6.2 Description: A critical issue has been discovered, allowing for SQL injection through the manipulation of the sort argument in the "/news/list?limit=10&offset=0&order=desc" API endpoint. This can be exploited remotely...

PT-2023-22337 · Unknown · Yoga Class Registration System

Name of the Vulnerable Software and Affected Versions: Yoga Class Registration System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the cid parameter at the "/admin/login.php" API endpoint. Recommendations: For Yoga Class...

PT-2023-17437 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: novel-plus version 3.6.2 Description: A critical issue was found in the software, affecting an unknown functionality of the file "/category/list?limit=10&offset=0&order=desc". The manipulation of the sort argument leads to SQL injection. This...

PT-2023-21215 · Unknown · Dg3450 Cable Gateway

Name of the Vulnerable Software and Affected Versions: DG3450 Cable Gateway version AR01.02.056.18 041520 711.NCS.10 Description: An issue was discovered in the log file download functionality of the troubleshooting logs download.php file, which does not check the session cookie. This allows an...

PT-2023-2583 · NetGear · Netgear Srx5308

Name of the Vulnerable Software and Affected Versions: Netgear SRX5308 versions up to 4.3.5-3 Description: The issue is related to insufficient protection of the web page structure when handling the USERDBUsers.Password argument in the web management interface of Netgear SRX5308 routers. This can...

PT-2023-22329 · Lmxcms · Lmxcms

Name of the Vulnerable Software and Affected Versions: lmxcms version 1.4.1 Description: The issue is a SQL injection vulnerability. It can be exploited via the setbook parameter at the "index.php" endpoint. Recommendations: For lmxcms version 1.4.1, consider restricting access to the setbook...

PT-2023-18790 · Tigergraph · Tigergraph Enterprise Free Edition

Name of the Vulnerable Software and Affected Versions: TigerGraph Enterprise Free Edition versions 3.x Description: The issue allows for unsecured read access to an SSH private key. Any code running as the tigergraph user can read the SSH private key, granting an attacker password-less SSH access...

DRUPAL-CONTRIB-2023-013

This module enables you to secure any page with a password. The module does not sufficiently restrict access to the page content...

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server’s server lies in the incorrect restriction on the path to the restricted-access catalog, which allows attackers to gain unauthorized access to protected information.

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server relates to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

PT-2023-22759 · Hashicorp +1 · Hashicorp Consul +2

Name of the Vulnerable Software and Affected Versions: Jenkins Consul KV Builder Plugin versions 2.0.13 and earlier Description: The issue concerns the storage of the HashiCorp Consul ACL Token in the global configuration file on the Jenkins controller. This token is stored unencrypted and can be...

PT-2023-22751 · Jenkins · Jenkins Report Portal Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Report Portal Plugin versions 0.5 and earlier Description: The Jenkins Report Portal Plugin stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These tokens can...

PT-2023-20908 · Prestashop · Prestashop Advancedpopupcreator

Name of the Vulnerable Software and Affected Versions: Prestashop advancedpopupcreator versions 1.1.21 through 1.1.24 Description: The issue is related to a SQL injection vulnerability. It affects the component AdvancedPopup::getPopups. Recommendations: For versions 1.1.21 through 1.1.24, conside...

CVE-2023-26406 ZDI-CAN-20712: Net.HTTP.request URL restriction bypass

Adobe Acrobat Reader versions 23.001.20093 and earlier and 20.005.30441 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must...

CVE-2022-43947

An improper restriction of excessive authentication attempts vulnerability CWE-307 in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 administrative interface allows an attacker with a valid user account to perform brute-forc...

CVE-2023-25955

National land numerical information data conversion tool all versions improperly restricts XML external entity references XXE. By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker...

Out-of-bounds

Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is vulnerable to improper restriction of operations within the bounds of a memory buffer CWE-119 due to improper check of its data size when processing a project file. If a user of Screen Creator Advance 2 opens a specially crafted project...

PT-2023-17327 · Sap · Sap Hcm Fiori App My Forms

Name of the Vulnerable Software and Affected Versions: SAP HCM Fiori App My Forms Fiori 2.0 version 605 Description: The issue concerns the lack of necessary authorization checks for authenticated users, resulting in exposure of restricted header data. Recommendations: For SAP HCM Fiori App My...

PT-2023-2430 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows versions 2008 R2 SP1 through 2019 Description: The issue is related to insufficient input validation in the Windows DHCP server service, allowing remote attackers to execute arbitrary code. This can be achieved through remote procedur...

PT-2023-2949 · Schneider Electric · Easergy Builder Installer

Name of the Vulnerable Software and Affected Versions: Easergy Builder Installer versions 1.7.23 and prior Description: The issue is related to an uncontrolled search path element in the installer, which could allow an attacker with a local privileged account to execute arbitrary code during the...

NewStart CGSL CORE 5.05 / MAIN 5.05 : tracker Vulnerability (NS-SA-2023-0020)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has tracker packages installed that are affected by a vulnerability: - It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access ...