PT-2023-24553 · Unknown · Fm Service

Name of the Vulnerable Software and Affected Versions: FM service affected versions not specified Description: The issue is related to a possible missing parameters check in the FM service. This could lead to a local denial of service, and system execution privileges are needed to exploit it...

PT-2023-20259 · WordPress · Pagup Wordpress Robots.Txt Optimization Plugin

Name of the Vulnerable Software and Affected Versions: Pagup WordPress Robots.Txt optimization plugin versions 1.4.5 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

Two Spyware Apps on Google Play with 1.5 Million Users Sending Data to China

Two file management apps on the Google Play Store have been discovered to be spyware, putting the privacy and security of up to 1.5 million Android users at risk. These apps engage in deceptive behaviour and secretly send sensitive user data to malicious servers in China. Pradeo, a leading mobile...

PT-2023-25818 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: A command injection issue was found in the setTracerouteCfg function via the command parameter. Recommendations: For version 17.0.0cu.557 B20221024, consider disabling the...

PT-2023-12345 · Ibm · Ibm Cloud Object System

Name of the Vulnerable Software and Affected Versions: IBM Cloud Object System version 3.15.8.97 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session. Th...

PT-2023-25817 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: A command injection issue was found in the setDiagnosisCfg function via the ip parameter. Recommendations: For version 17.0.0cu.557 B20221024, avoid using the ip parameter in the...

PT-2023-18414 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: An OS command injection issue exists in the libzebra.so bridge group functionality. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to...

PT-2023-5077 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: Multiple buffer overflow vulnerabilities exist in the vtysh ubus binary due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An...

PT-2023-19050 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: An access violation issue exists in the eventcore functionality. A specially crafted network request can lead to denial of service. An attacker can send a network request to trigger this issue...

PT-2023-22634 · Unknown · Chatengine

Name of the Vulnerable Software and Affected Versions: ChatEngine version 1.0 Description: The issue allows attackers to gain sensitive information through a SQL Injection vulnerability in the textMessage parameter in the /src/chatbotapp/chatWindow.java file. Recommendations: For ChatEngine versi...

PT-2023-19028 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: A misconfiguration issue exists in the urvpn client functionality, allowing a specially-crafted man-in-the-middle attack to lead to increased privileges. An attacker can exploit this by performing...

PT-2023-19666 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: A command injection issue exists in the vtysh ubus tool's toolsh excute.constprop.1 functionality, specifically within the ping tool utility. This allows an attacker to execute commands by sending...

PT-2023-5073 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: The issue is caused by multiple buffer overflow vulnerabilities in the vtysh ubus binary due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code...

PT-2023-5150 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: The issue is caused by a buffer overflow vulnerability in the handle interface acl function of the Milesight UR32L router's firmware. This vulnerability can be exploited by a remote attacker to...

PT-2023-5020 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: The issue is caused by a buffer overflow vulnerability in the firewall handler set function, allowing a remote attacker to execute arbitrary code. This occurs due to the use of an unsafe sprintf...

PT-2023-21093 · Diagon · Diagon

Name of the Vulnerable Software and Affected Versions: Diagon version 1.0.139 Description: A heap-based buffer overflow vulnerability exists in the Sequence::DrawText functionality. This issue can be triggered by a specially crafted markdown file or network request, potentially leading to arbitra...

PT-2023-25630 · Tbox Rtus +1 · Tbox Rtus +1

Name of the Vulnerable Software and Affected Versions: TBox RTUs affected versions not specified Description: The issue concerns TBox RTUs that run OpenVPN with root privileges and are capable of executing user-defined configuration scripts. An attacker can set up a local OpenVPN server and push ...

PT-2023-11882 · WordPress · Custom Field Template

Name of the Vulnerable Software and Affected Versions: Custom Field Template plugin for WordPress versions up to, and including, 2.5.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the edit meta value function. This allows...

PT-2023-8738 · Softether · Softether Vpn

Name of the Vulnerable Software and Affected Versions: SoftEther VPN versions 4.41-9782-beta through 5.02 Description: A denial of service issue exists in the DCRegister functionality of SoftEther VPN, related to the DDNS RPC MAX RECV SIZE. This can be triggered by a specially crafted network...

PT-2023-24990 · Unknown · Property Cloud Platform Management Center

Name of the Vulnerable Software and Affected Versions: Property Cloud Platform Management Center version 1.0 Description: The issue is related to error-based SQL injection. Recommendations: For Property Cloud Platform Management Center version 1.0, at the moment, there is no information about a...