CVE-2023-49920: Cross-Site Request Forgery (CSRF)

Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the executi...

FreeBSD : putty -- add protocol extension against 'Terrapin attack' (91955195-9ebb-11ee-bc14-a703705db3a6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 91955195-9ebb-11ee-bc14-a703705db3a6 advisory. - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other...

CVE-2023-33330: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.50...

CVE-2023-28491: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: from n/a through 1.7.6...

CVE-2023-50372

Cross-Site Request Forgery CSRF vulnerability in Hiroaki Miyashita Custom Post Type Page Template.This issue affects Custom Post Type Page Template: from n/a through 1.1...

Zabbix Security Vulnerabilities

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring, and application monitoring. A security vulnerability exists in Zabbix Server, which stems from a vulnerability that allows an attacker to execute arbitrary code on...

PT-2023-30588 · Clever · Delete Duplicate Posts

Name of the Vulnerable Software and Affected Versions: Delete Duplicate Posts versions n/a through 4.8.9 Description: The issue is related to a Missing Authorization vulnerability in Clever plugins, specifically in the Delete Duplicate Posts plugin. This vulnerability allows accessing functionali...

CVE-2023-47789: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3...

VulnCheck KEV: CVE-2023-26067

Certain Lexmark devices through 2023-02-19 mishandle Input Validation issue 1 of 4...

CVE-2023-4406

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS.This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2023-3631

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Medart Health Services Medart Notification Panel allows SQL Injection. This issue affects Medart Notification Panel: through 20231123. NOTE: The vendor was contacted early about this disclosure but...

PT-2023-24483 · Veribase · Veribase

Name of the Vulnerable Software and Affected Versions: Veribase versions through 20231123 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. The vendor was contacted...

PT-2023-28094 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 773 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting XSS. This allows users with low privileges to introduce Javascript...

PT-2023-7101 · Unknown +6 · Strongswan +6

Name of the Vulnerable Software and Affected Versions: strongSwan versions 5.3.0 through 5.9.11 Description: The issue is caused by a buffer overflow in the charon-tkm process with IKE protocol implementation based on TKMv2, leading to possible unauthenticated remote code execution via a DH publi...

CVE-2023-47651: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Robert Macchi WP Links Page.This issue affects WP Links Page: from n/a through 4.9.4...

CVE-2023-47671: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Gopi Ramasamy Vertical scroll recent.This issue affects Vertical scroll recent post: from n/a through 14.0...

kernel: dmaengine: ptdma: check for null desc before calling pt_cmd_callback

AMD PTDMA Pass-Through DMA engine crashes the kernel when ptissuepending encounters empty descriptor queues. The function blindly invokes ptcmdcallback without verifying that a valid descriptor exists, triggering a NULL pointer dereference. This commonly surfaces during system shutdown on AMD...

CVE-2023-47516

Cross-Site Request Forgery CSRF vulnerability in Stark Digital Category Post List Widget allows Stored XSS.This issue affects Category Post List Widget: from n/a through 2.0...

CVE-2023-32123: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Dream-Theme The7 allows Stored XSS.This issue affects The7: from n/a through 11.7.3...

PT-2023-30439 · Headscale · Headscale

Name of the Vulnerable Software and Affected Versions: Headscale versions through 0.22.3 Description: The issue allows Headscale to write bearer tokens to info-level logs. Recommendations: For versions through 0.22.3, consider restricting log access to minimize the risk of exploitation. At the...