PT-2023-12116 · Mblog · Mblog

Name of the Vulnerable Software and Affected Versions: mblog version 3.5.0 Description: The issue allows attackers to execute arbitrary code via a crafted theme when it gets selected. This is due to an OS Command injection vulnerability. Recommendations: For mblog version 3.5.0, update to a newer...

JVN#01937209: LINE WORKS Drive Explorer vulnerable to code injection

LINE WORKS Drive Explorer provided by WORKS MOBILE Japan Corp. contains a code injection vulnerability CWE-94. Impact An attacker who can login to the client where the affected product is installed may inject arbitrary code while processing the product execution. Since a full disk access privileg...

PT-2023-17932 · WordPress · Nex-Forms

Name of the Vulnerable Software and Affected Versions: NEX-Forms WordPress plugin versions prior to 8.4 Description: The issue arises from improper escaping of the table parameter, which is populated with user input, before it is concatenated to an SQL query. Recommendations: For versions prior t...

MGASA-2023-0158 Updated avahi packages fix security vulnerability

Fixes crash on some invalid DBus calls. CVE-2023-1981...

PT-2023-12684 · Ibm · Ibm Qradar Data Synchronization App

Name of the Vulnerable Software and Affected Versions: IBM QRadar Data Synchronization App versions 1.0 through 3.0.1 Description: The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information...

GHSA-J4MX-98HW-6RV6 craftcms/cms vulnerable to cross site scripting in RSS feed widget

A malformed title in the feed widget of craftcms/cms can deliver an XSS payload. This has been resolved in this commit...

SUSE-SU-2023:2115-1 Security update for ffmpeg

This update for ffmpeg fixes the following issues: - CVE-2019-13390: Fixed a potential crash when processing a crafted AVI stream bsc1140754. - CVE-2022-3341: Fixed a potential crash when processing a crafted NUT stream bsc1206778. - CVE-2022-48434: Fixed use after free in libavcodec/pthreadframe...

PT-2023-14398 · Ibm · Ibm Mq

Name of the Vulnerable Software and Affected Versions: IBM MQ versions 9.2 CD through 9.3 LTS Description: The issue allows an authenticated attacker with authorization to craft messages to cause a denial of service. Recommendations: For IBM MQ versions 9.2 CD through 9.3 LTS, update to a version...

PT-2023-20115 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.13 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation, allowing attackers to injec...

PT-2023-18242 · Unknown · Bootloader

Name of the Vulnerable Software and Affected Versions: Bootloader versions prior to SMR May-2023 Release 1 Description: A heap out-of-bounds write issue allows a physical attacker to execute arbitrary code. Recommendations: For versions prior to SMR May-2023 Release 1, update to SMR May-2023...

PT-2023-18260 · Samsung · Samsung Core Service

Name of the Vulnerable Software and Affected Versions: Samsung Core Service versions prior to 2.1.00.36 Description: The issue is related to improper access control in the Samsung Core Service, allowing an attacker to write arbitrary files in the sandbox. Recommendations: For versions prior to...

PT-2023-15325 · Rextheme · Rextheme Cart Lift – Abandoned Cart Recovery For Woocommerce/Edd

Name of the Vulnerable Software and Affected Versions: RexTheme Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD plugin versions = 3.1.5 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious...

PT-2023-18261 · Samsung · Samsung Blockchain Keystore

Name of the Vulnerable Software and Affected Versions: Samsung Blockchain Keystore versions prior to 1.3.12.1 Description: The issue is related to an Out-of-bounds Write vulnerability that occurs while processing the BC TUI CMD SEND RESOURCE DATA ARRAY command in the bc tui trustlet. This allows ...

PT-2023-18251 · Unknown · Mpos Tui Trustlet

Name of the Vulnerable Software and Affected Versions: mPOS TUI trustlet versions prior to SMR May-2023 Release 1 Description: The issue allows local attackers to access the memory address due to the use of an externally-controlled format string vulnerability in the mPOS TUI trustlet...

PT-2023-18247 · Unknown · Semsharefileprovider

Name of the Vulnerable Software and Affected Versions: SemShareFileProvider versions prior to SMR May-2023 Release 1 Description: The issue is related to improper access control, allowing local attackers to access protected data. Recommendations: For versions prior to SMR May-2023 Release 1, upda...

PT-2023-18628 · Clio Grow · Clio Grow

Name of the Vulnerable Software and Affected Versions: Clio Grow plugin versions prior to 1.0.0 Description: A Stored Cross-Site Scripting XSS vulnerability exists, allowing authentication bypass for admin+ users. Recommendations: For versions prior to 1.0.0, update to version 1.0.0 or later to...

Important: tomcat9

Issue Overview: The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing but extremely hard to trigger concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5...

PT-2023-16945 · Amazon +1 · Amazon Fire Tv Stick +1

Name of the Vulnerable Software and Affected Versions: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5 Insignia TV with FireOS versions prior to 7.6.3.3 Description: An issue with the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are...

PT-2023-16947 · Amazon +1 · Fire Os +2

Name of the Vulnerable Software and Affected Versions: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5 Insignia TV with FireOS version 7.6.3.3 Description: The issue is related to an improper JPAKE implementation, which allows offline PIN brute-forcing due to the initialization of random...

PT-2023-19274 · WordPress · Wpdatatables

Name of the Vulnerable Software and Affected Versions: wpDataTables plugin versions = 2.1.49 Description: A Stored Cross-Site Scripting XSS vulnerability exists, allowing contributors or higher-privileged users to inject malicious scripts. Recommendations: For wpDataTables plugin versions = 2.1.4...