PT-2024-19008 · Pimcore · Pimcore Customer Management Framework

Name of the Vulnerable Software and Affected Versions: Pimcore Customer Management Framework versions prior to 4.0.6 Description: The issue allows an authenticated and unauthorized user to access the list of potential duplicate users and see their data. This occurs because permissions are not...

PT-2023-9281 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions 7260 and below Description: The issue is related to insufficient access control in Zoho ManageEngine ADAudit Plus, a Windows Active Directory management and reporting tool. This allows unauthorized loca...

PT-2023-31693 · Unknown · Tms Booking For Appointments/Events Calendar – Amelia

Name of the Vulnerable Software and Affected Versions: TMS Booking for Appointments and Events Calendar – Amelia versions 1.0 through 1.0.85 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means...

PT-2023-32634 · Alkacon · Opencms

Name of the Vulnerable Software and Affected Versions: Alkacon Software Open CMS versions 14 through 15 of the 'Mercury' template Description: A cross-site scripting XSS issue affects the software, allowing a remote attacker to send a specially crafted JavaScript payload to a victim, potentially...

CVE-2023-49092 RustCrypto/RSA vulnerable to a Marvin Attack via key recovery through timing sidechannels

RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is...

PT-2023-30518 · Unknown · Guest Entries

Name of the Vulnerable Software and Affected Versions: Guest Entries versions prior to 3.1.2 Description: The file uploads feature in Guest Entries did not prevent the upload of PHP files, which may lead to code execution on the server by authenticated users. Recommendations: For versions prior t...

PT-2023-7093 · Asus · Asus Rt-Ax57

Name of the Vulnerable Software and Affected Versions: ASUS RT-AX57 version 3.0.0.4 386 52041 Description: The issue exists due to insufficient input validation in the sub 4CCE4 function of the ASUS RT-AX57 Wi-Fi router's firmware. This allows a remote attacker to execute arbitrary code by sendin...

PT-2023-27668 · Tengda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tengda AC6 version US AC6V1.0BR V15.03.05.16 multi TD01.bin Description: The issue is related to a Buffer Overflow that can be exploited via the R7WebsSecurityHandler function. Recommendations: For Tengda AC6 version US AC6V1.0BR V15.03.05.16...

PT-2023-27076 · Gz Scripts · Gz Scripts Availability Booking Calendar Php

Name of the Vulnerable Software and Affected Versions: GZ Scripts Availability Booking Calendar PHP version 1.0 Description: A problematic issue was found in the Image Handler component, affecting the /index.php?controller=GzUser&action=edit&id=1 file. The manipulation of the img argument leads t...

PT-2023-25217 · Unknown · Gz Scripts Time Slot Booking Calendar Php

Name of the Vulnerable Software and Affected Versions: GZ Scripts Time Slot Booking Calendar PHP version 1.8 Description: A vulnerability was found in the software, affecting unknown code of the file /load.php. The manipulation of the arguments first name, second name, phone, address 1, country...

CVE-2023-36468 Upgrading doesn't prevent exploiting vulnerable XWiki documents

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrade contains a fix for a bug in a document, just a new version of that document is added. In some cases, it's still possible to exploit the...

PT-2023-22065 · WordPress · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce plugin versions = 2.1.48 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability in the PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, and...

PT-2023-25184 · Livebook · Livebook

Name of the Vulnerable Software and Affected Versions: Livebook versions prior to 0.8.2 Livebook versions prior to 0.9.3 Description: The issue allows arbitrary code execution on a victim's machine when a livebook:// link is opened from a browser, triggering Livebook Desktop to execute the code...

PT-2023-3599

Name of the Vulnerable Software and Affected Versions Requests versions 2.3.0 through 2.30.0 Description The issue is related to the leaking of Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This occurs due to how the rebuild proxies function is used to...

PT-2023-22765 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable and tests-passed versions Description: The issue arises from the improper sanitization of SVG files, allowing an attacker to execute arbitrary JavaScript on users' browsers by uploading a crafted...

PT-2023-2331 · Rocket · Universe +1

Name of the Vulnerable Software and Affected Versions: Rocket Software UniData versions prior to 8.2.4 build 3003 Rocket Software UniVerse versions prior to 11.3.5 build 1001 Rocket Software UniVerse versions prior to 12.2.1 build 2002 Description: The issue is related to an authentication bypass...

PT-2023-19956 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.0.1 Description: PrestaShop is an open source e-commerce web application that is vulnerable to cross-site request forgery CSRF. When authenticating users, PrestaShop preserves session attributes, which does not...

PT-2023-10347 · Icepay · Icepay Rest-Api-Net

Name of the Vulnerable Software and Affected Versions: ICEPAY REST-API-NET version 0.9 Description: A vulnerability was found in the function RestClient of the file Classes/RestClient.cs of the component Checksum Validation. The manipulation leads to improper validation of integrity check value...

PT-2023-20690 · Ghost · Ghost

Name of the Vulnerable Software and Affected Versions: Ghost version 5.35.0 Description: The issue allows contributors to view draft posts of other users, which may be inconsistent with a security policy where a contributor's draft should only be readable by editors until published. The vendor do...

CVE-2023-25570 Apollo has potential access control security issue in eureka

Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet, which is not recommended. This is because there is no authentication feature enabled for the built-in eureka service. Malicious hackers ma...