PT-2023-20977 · Opencrx · Opencrx

Name of the Vulnerable Software and Affected Versions: openCRX version 5.2.0 Description: The issue is related to an HTML injection vulnerability in the Search Criteria-Activity Number within the Saved Search Activity. This vulnerability can be exploited via the Name, Description, or Activity...

PT-2023-26359 · Opennds +1 · Opennds +1

Name of the Vulnerable Software and Affected Versions: OpenNDS versions prior to 4.17.0.12 Description: The issue allows remote attackers to cause a denial of service through a GET request to "/opennds auth/" that lacks a custom query string parameter and client-token, resulting in a NULL pointer...

CVE-2023-51386

CVE-2023-51386 affects Sandbox Accounts for Events. An authenticated user could read data from the events table by sending requests to the events API, exposing information such as planned events, timeframes, budgets, and owner email addresses. The issue has been patched in version 1.10.0. Affecte...

CVE-2023-50928

"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event...

Deserialization of untrusted data

"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event...

CVE-2023-50928 sandbox-accounts-for-events security misconfiguration leads to budget exceed

"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event...

CVE-2023-50731 MindsDB has arbitrary file write in file.py

MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which...

PT-2023-8237 · Siemens · Jt2Go +1

Name of the Vulnerable Software and Affected Versions: JT2Go versions prior to 14.3.0.6 Teamcenter Visualization V13.3 versions prior to 13.3.0.13 Teamcenter Visualization V14.1 versions prior to 14.1.0.12 Teamcenter Visualization V14.2 versions prior to 14.2.0.9 Teamcenter Visualization V14.3...

CentOS 7 : insights-client (RHSA-2023:6795)

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6795 advisory. - A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and...

PT-2023-13720 · Hertzbeat · Hertzbeat

Name of the Vulnerable Software and Affected Versions: Hertzbeat versions 1.20 and prior Description: Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless capabilities. The system has a permission bypass issue,...

PT-2023-8145

Name of the Vulnerable Software and Affected Versions Barracuda ESG Appliance versions 5.1.3.001 through 9.2.1.001 Description The issue is related to a case of arbitrary code execution that resides within a third-party and open-source library named Spreadsheet::ParseExcel, used by the Amavis...

PT-2023-31576 · Unknown · Nos Client

Name of the Vulnerable Software and Affected Versions: nos client version 0.6.6 Description: An issue was discovered in the nos client, allowing remote attackers to escalate privileges via the getRPCEndpoint.js file. Recommendations: For nos client version 0.6.6, consider disabling the...

PT-2023-32461

Name of the Vulnerable Software and Affected Versions LioXERP versions prior to 146 Description The issue affects LioXERP, allowing Reflected XSS due to improper neutralization of input during web page generation. This can lead to cross-site scripting attacks. Recommendations For versions prior t...

PT-2023-29419 · Unknown · Online Examination System

Name of the Vulnerable Software and Affected Versions: Online Examination System version 1.0 Description: The issue concerns multiple Authenticated SQL Injection vulnerabilities. Specifically, the qid parameter of the "/update.php?q=quiz&step=2" resource does not validate the characters received,...

PT-2023-31286 · Unknown · Job Portal

Name of the Vulnerable Software and Affected Versions: Job Portal version 1.0 Description: The issue concerns an Unauthenticated SQL Injection vulnerability. Specifically, the txtDesc parameter of the "Employer/InsertJob.php" resource does not validate the characters received, and they are sent...

PT-2023-31250 · Unknown · Book Store Management System

Name of the Vulnerable Software and Affected Versions: Book Store Management System version 1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the category parameter in the "/bsms ci/index.php/category" API endpoint. This enabl...

PT-2023-24289 · Woocommerce · Automatewoo

Name of the Vulnerable Software and Affected Versions: AutomateWoo versions 4.9.40 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability in WooCommerce AutomateWoo. This allows for the upload of files with potentially dangerous types,...

PT-2023-20701 · Wedevs · Wedevs Dokan

Name of the Vulnerable Software and Affected Versions: weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy versions n/a through 3.7.12 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also...

PT-2023-22257 · WordPress · Houzez

Name of the Vulnerable Software and Affected Versions: Houzez - Real Estate WordPress Theme versions prior to 2.8.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation...

PT-2023-32815 · Codelyfe · Codelyfe Stupid Simple Cms

Name of the Vulnerable Software and Affected Versions: codelyfe Stupid Simple CMS versions up to 1.2.4 Description: A critical issue has been found in the Deletion Interface component, specifically in the /file-manager/delete.php file. The manipulation of the file argument leads to improper...