PT-2023-16277 · WordPress · My Youtube Channel

Name of the Vulnerable Software and Affected Versions: My YouTube Channel plugin for WordPress versions up to, and including, 3.0.12.1 Description: The issue is related to authorization bypass due to a missing capability check on the clear all cache function. This allows authenticated attackers...

MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`

MITM can enable Zip-Slip...

PT-2023-14470 · WordPress · Brutebank

Name of the Vulnerable Software and Affected Versions: BruteBank WordPress plugin versions prior to 1.9 Description: The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations: For versions...

[SECURITY] Fedora 37 Update: sudo-1.9.12-1.p2.fc37

Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...

PT-2023-19375 · Lightftp · Lightftp

Name of the Vulnerable Software and Affected Versions: LightFTP versions 1.0 through 2.2 LightFTP version 2.2 Description: A race condition in the software allows an attacker to achieve path traversal via a malformed FTP request. This occurs because a handler thread can use an overwritten...

CVE-2023-22339

Improper access control vulnerability in CONPROSYS HMI System CHS Ver.3.4.5 and earlier allows a remote unauthenticated attacker to bypass access restriction and obtain the server certificate including the private key of the product...

PT-2023-14692 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: EyouCMS versions 1.6.0 and earlier Description: A reflected-XSS issue was discovered in the article publish component. The issue is related to the cookie ENV LIST URL. Recommendations: For EyouCMS versions 1.6.0 and earlier, update to a versi...

PT-2023-15581 · Totolink · Totolink A7100Ru

Name of the Vulnerable Software and Affected Versions: TOTOlink A7100RU version 7.4cu.2313 B20191024 Description: A command injection issue was found via the rsabits parameter in the setting/delStaticDhcpRules function. This allows for potential exploitation. Recommendations: For TOTOlink A7100RU...

PT-2023-7929 · Tenable · Nessus

Name of the Vulnerable Software and Affected Versions: Nessus versions 8.10.1 through 8.15.8 Nessus versions 10.0.0 through 10.4.1 Description: The issue is related to insufficient input validation, which can be exploited by a remote attacker to elevate privileges to root or NT AUTHORITY/SYSTEM o...

PT-2023-1551 · Unknown +2 · Html-Stripscripts +2

Name of the Vulnerable Software and Affected Versions: HTML-StripScripts versions 1.06 and earlier Description: The issue is related to the hss attval style function in the HTML-StripScripts module, which allows ReDoS Regular expression Denial of Service due to catastrophic backtracking when...

PT-2023-15473 · Kraken · Kraken

Name of the Vulnerable Software and Affected Versions: kraken versions 0.1.4 and earlier Description: The issue is related to an arbitrary file read vulnerability. It affects the component testfs. Recommendations: For kraken versions 0.1.4 and earlier, consider restricting access to the testfs...

PT-2025-13333 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability has been resolved in the Linux kernel related to the ASoC: SOF: ipc4-mtrace component. The issue involves preventing an underflow in the sof ipc4 priority mask dfs writ...

PT-2023-9883 · Ruby · Jruby-Openssl

Name of the Vulnerable Software and Affected Versions: jruby-openssl gem versions prior to 0.6 Description: A security issue was found in the handling of SSL certificate validation, where failed verification did not properly alert the application, making it vulnerable to attacks. This could allow...

LienToken.transferFrom There is a possibility of malicious attack

Lines of code Vulnerability details Impact Corrupt multiple key properties of public vault, causing vault not to function properly Proof of Concept When LienToken.makePayment/buyoutLien/payDebtViaClearingHouse If it corresponds to PublicVault, it will make multiple changes to the vault, such as:...

PT-2023-14799 · Opentext · Opentext Content Suite Platform

Name of the Vulnerable Software and Affected Versions: OpenText Content Suite Platform version 16.2.19.1803 Description: An issue was discovered that allows a low-privilege user to evaluate web reports through the "notify.localizeEmailTemplate" endpoint. Recommendations: For OpenText Content Suit...

PT-2023-16050 · Unknown · Orangescrum

Name of the Vulnerable Software and Affected Versions: OrangeScrum version 2.0.11 Description: The issue allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function...

PT-2023-14797 · Opentext · Opentext Content Suite Platform

Name of the Vulnerable Software and Affected Versions: OpenText Content Suite Platform version 16.2.19.1803 Description: An issue was discovered that allows a low-privilege user to delete arbitrary files on the server's local filesystem through the "itemtemplate.createtemplate2" endpoint...

PT-2023-13403 · Dell · Idrac8

Name of the Vulnerable Software and Affected Versions: Dell iDRAC8 versions 2.83.83.83 and prior Description: The issue is related to an improper input validation in Racadm when the firmware lock-down configuration is set, allowing a remote high privileged attacker to bypass this configuration an...

GSD-2023-1000091 wifi: cfg80211: don't allow multi-BSSID in S1G

wifi: cfg80211: don't allow multi-BSSID in S1G This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.12 by commit...

PT-2023-33209 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.15 through v5.15.82 Description: A potential memory leak was identified in the otx2 init tc function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions v5.1...