PT-2023-11539 · Unknown · Directus Api

Name of the Vulnerable Software and Affected Versions: Directus API version 2.2.0 Description: A denial of service issue in the Directus API allows a remote attacker to cause a denial of service by sending a large number of HTTP requests. Recommendations: For Directus API version 2.2.0, consider...

PT-2023-16124 · Uvdesk · Uvdesk

Name of the Vulnerable Software and Affected Versions: Uvdesk version 1.1.1 Description: The issue allows an authenticated remote attacker to execute commands on the server due to improper validation of profile pictures uploaded by customers. Recommendations: For Uvdesk version 1.1.1, consider...

PT-2023-14003 · Peepso · Peepso Community

Name of the Vulnerable Software and Affected Versions: PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin versions = 6.0.2.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing...

PT-2023-11645 · Jsish · Jsish

Name of the Vulnerable Software and Affected Versions: Jsish versions 3.0.11 and earlier Description: An issue in Jsish allows an attacker to cause a denial of service via the StringReplaceCmd function in the src/jsiChar.c file. Recommendations: For versions 3.0.11 and earlier, consider disabling...

PT-2023-9834

Name of the Vulnerable Software and Affected Versions pgadmin affected versions not specified Description A vulnerability was found in pgadmin, where users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attemp...

PT-2023-15314 · Unknown · Wpdevart Booking Calendar +1

Name of the Vulnerable Software and Affected Versions: WpDevArt Booking calendar, Appointment Booking System plugin versions 3.2.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by authenticated users with edit...

PT-2023-15425 · Joomunited · Wp Table Manager

Name of the Vulnerable Software and Affected Versions: JoomUnited WP Table Manager plugin versions prior to 3.5.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher privileges. There is no...

PT-2023-17183 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.20 Description: The issue is related to Cross-site Scripting XSS - Generic in the GitHub repository pimcore/pimcore. This is a type of security vulnerability that can allow an attacker to inject maliciou...

PT-2023-20257 · Unknown · Mehjabin Orthi Interactive Svg Image Map Builder

Name of the Vulnerable Software and Affected Versions: Mehjabin Orthi Interactive SVG Image Map Builder plugin versions = 1.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the...

PT-2023-2592 · Forgerock · Openid +1

Name of the Vulnerable Software and Affected Versions: OpenIDM and Java Remote Connector Server RCS versions 1.5.20.9 through 1.5.20.13 Description: The issue is related to the cleartext transmission of sensitive information, which can allow remote services to access protected information with...

PT-2023-16308 · WordPress · Hm Portfolio

Name of the Vulnerable Software and Affected Versions: HT Portfolio WordPress plugin versions prior to 1.1.6 Description: The issue concerns a lack of CSRF check when activating plugins, which could allow attackers to make logged-in admins activate arbitrary plugins present on the blog via a CSRF...

PT-2023-12657 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In the parseTrackFragmentRun function of MPEG4Extractor.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to remote escalation of privilege with no additional...

PT-2023-18659 · Unknown · Oopspam Anti-Spam Plugin

Name of the Vulnerable Software and Affected Versions: OOPSpam Anti-Spam plugin versions 1.1.35 and earlier Description: The issue is related to an Authenticated admin+ Cross-Site Scripting vulnerability. There is no information provided about the estimated number of potentially affected devices...

PT-2023-12948 · Totolink · Totolink Outdoor Cpe Cp900

Name of the Vulnerable Software and Affected Versions: TOTOLink outdoor CPE CP900 version 6.3c.566 B20171026 Description: The issue concerns a command injection vulnerability in the setPasswordCfg function, which can be exploited via the adminuser and adminpass parameters. This allows attackers t...

PT-2023-21900 · Jenkins · Jenkins Visual Studio Code Metrics Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Visual Studio Code Metrics Plugin versions 1.7 and earlier Description: The issue is related to the XML parser not being configured to prevent XML external entity XXE attacks. This allows attackers who can control VS Code Metrics File...

PT-2023-1973 · Tp Link · Tp-Link Mr3020

Name of the Vulnerable Software and Affected Versions: TP-Link MR3020 version 1 150921 Description: A command injection issue allows a remote attacker to execute arbitrary commands via a crafted request to the "tftp endpoint". This issue is related to the lack of data cleaning measures at the...

PT-2023-21322 · Vox2Mesh · Vox2Mesh

Name of the Vulnerable Software and Affected Versions: vox2mesh version 1.0 Description: The issue is caused by a stack-overflow in the main.cpp file due to the incorrect use of the memcpy function. This allows an attacker to cause a denial of service abort via a crafted file. Recommendations: Fo...

PT-2023-17078 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue allows an attacker to learn the full name of a board owner due to Mattermost failing to check the "Show Full Name" setting when rendering the result for the...

PT-2023-21888 · WordPress · The Lead Generated Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Lead Generated WordPress Plugin version = 1.23 Description: The issue is related to an unauthenticated insecure deserialization problem. The tve labels parameter of the tve api form submit action is passed to the PHP unserialize function...

PT-2023-20243 · Ibm · Ibm Security Guardium Key Lifecycle Manager

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Key Lifecycle Manager versions 3.0 through 4.1.1 Description: The issue allows a remote attacker to send specially crafted SQL statements, which could enable the attacker to view, add, modify, or delete information in th...