PT-2023-3013 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 11.1 and 11.5 Description: The issue is related to insufficient input validation in the database management system, which can be exploited by a remote attacker to cause ...

PT-2023-19547 · Unknown · Karishma Arora Ai Contact Us Form

Name of the Vulnerable Software and Affected Versions: Karishma Arora AI Contact Us Form plugin versions 1.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. This vulnerability can be...

PT-2023-22467 · H3C · H3C Magic R200

Name of the Vulnerable Software and Affected Versions: H3C Magic R200 version R200V100R004 Description: A stack overflow issue was discovered via the UpdateMacClone interface at the "/goform/aspForm" API endpoint. This issue affects the specified version of the H3C Magic R200. Recommendations: Fo...

PT-2023-22468 · H3C · H3C Magic R200

Name of the Vulnerable Software and Affected Versions: H3C Magic R200 version R200V100R004 Description: A stack overflow issue was discovered via the AddMacList interface at the "/goform/aspForm" API endpoint. This issue affects the H3C Magic R200 device. Recommendations: For H3C Magic R200 versi...

PT-2023-17227 · Snyk · Snyk Advisor

Name of the Vulnerable Software and Affected Versions: Snyk Advisor versions prior to 28th March 2023 Description: The issue concerns a stored XSS vulnerability. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create...

PT-2023-18417 · Tribe29 · Tribe29 Checkmk Appliance

Name of the Vulnerable Software and Affected Versions: Tribe29 Checkmk Appliance versions prior to 1.6.4 Description: The issue is related to Reflective Cross-Site-Scripting in Webconf. Recommendations: For versions prior to 1.6.4, update to version 1.6.4 or later to resolve the issue...

PT-2023-22525 · Unknown · Sourcecodester Judging Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Judging Management System version 1.0 Description: The issue is related to SQL Injection, which can be exploited via the "/php-jms/print judges.php" API endpoint with specific parameters such as se name and sub event id...

PT-2023-22784 · Archery · Archery

Name of the Vulnerable Software and Affected Versions: Archery affected versions not specified Description: The Archery project contains multiple SQL injection vulnerabilities that may allow an attacker to query connected databases. User input from the db name and tb name parameter values in the...

PT-2023-2635 · Oracle · Oracle Banking Virtual Account Management

Name of the Vulnerable Software and Affected Versions: Oracle Banking Virtual Account Management versions 14.5 through 14.7 Description: The issue is related to insufficient input validation in the OBVAM Trn Journal Domain component. It allows a high-privileged attacker with network access via HT...

PT-2023-22781 · Archery · Archery

Name of the Vulnerable Software and Affected Versions: Archery affected versions not specified Description: The Archery project contains multiple SQL injection issues that may allow an attacker to query connected databases. The sql api/api workflow.py endpoint ExecuteCheck passes unfiltered input...

PT-2023-19649 · Electra · Electra Central Ac Unit

Name of the Vulnerable Software and Affected Versions: Electra Central AC unit affected versions not specified Description: The issue concerns an Electra Central AC unit that opens an Access Point AP with a password that can be easily calculated. Recommendations: At the moment, there is no...

PT-2023-12939 · Mybb · External Redirect Warning Plugin

Name of the Vulnerable Software and Affected Versions: External Redirect Warning Plugin version 1.3 for MyBB Description: The issue concerns a problem where the redirect URL, also known as external.php?url=, is susceptible to XSS. This means an attacker could potentially inject malicious scripts...

PT-2023-15602

Name of the Vulnerable Software and Affected Versions X2CRM Open Source Sales CRM versions 6.6 through 6.9 Description A reflected cross-site scripting XSS issue was discovered in X2CRM Open Source Sales CRM. This issue allows attackers to create malicious JavaScript that will be executed by the...

PT-2023-14289 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev30 Description: The issue allows for cross-site scripting XSS via an activity tracking adapter defined by jslob. This can potentially lead to malicious script execution on the client-side...

PT-2023-21291 · Unknown · Auto Dealer Management System

Name of the Vulnerable Software and Affected Versions: Auto Dealer Management System version 1.0 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the name parameter at the "/classes/SystemSettings.php?f=update settings" API...

PT-2023-2758 · Nginx · Nginx Instance Manager +3

Name of the Vulnerable Software and Affected Versions: NGINX Management Suite affected versions not specified NGINX Instance Manager affected versions not specified NGINX API Connectivity Manager affected versions not specified NGINX Security Monitoring affected versions not specified Description...

PT-2023-18793 · Tigergraph · Tigergraph Enterprise Free Edition

Name of the Vulnerable Software and Affected Versions: TigerGraph Enterprise Free Edition versions 3.x Description: An issue allows data loading jobs in gsql server to read sensitive data from arbitrary locations. This issue affects jobs created by any user with designer permissions...

PT-2023-2753 · Fortinet · Fortinac-F +1

Name of the Vulnerable Software and Affected Versions: FortiNAC-F version 7.2.0 FortiNAC versions 9.4.2 and below FortiNAC versions 9.2 and earlier FortiNAC versions 8.8 and earlier FortiNAC versions 8.7 and earlier Description: A use of hard-coded credentials issue may allow an authenticated...

PT-2023-22748 · Jenkins · Jenkins Quay.Io Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Quay.io trigger Plugin versions 0.1 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin does not limit URL schemes for repository homepage URLs submitted via...

PT-2023-22752 · Jenkins · Jenkins Report Portal Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Report Portal Plugin versions 0.5 and earlier Description: The issue concerns the storage and display of ReportPortal access tokens. Specifically, the tokens are stored unencrypted in job config.xml files on the Jenkins controller and...