PT-2023-31833 · Gradio · Gradio

Name of the Vulnerable Software and Affected Versions: Gradio versions prior to 4.11.0 Description: The issue concerns a vulnerability in the /file route of Gradio, making it susceptible to file traversal attacks. An attacker could access arbitrary files on a machine running a Gradio app with a...

PT-2023-32820

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 23.12.13205.0 Description The issue is related to a lack of protection against brute force attacks, allowing an attacker to make unlimited authentication attempts. This could potentially compromise targeted...

PT-2023-8020 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.18 and earlier Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability in Adobe Experience Manager. This vulnerability can be exploited if a low-privileged attacker convinc...

PT-2023-32595 · WordPress · Siteorigin Widgets Bundle

Name of the Vulnerable Software and Affected Versions: SiteOrigin Widgets Bundle WordPress plugin versions prior to 1.51.0 Description: The issue allows users with the administrator role to perform Local File Inclusion LFI attacks in the context of Multisite WordPress sites. This is due to the...

PT-2023-7795 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.18 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form...

Security update for opera (important)

openSUSE Security Update: Security update for opera Announcement ID: openSUSE-SU-2023:0396-1 Rating: important References: Cross-References: CVE-2023-6345 CVE-2023-6346 CVE-2023-6347 CVE-2023-6348 CVE-2023-6350 CVE-2023-6351 CVSS scores: CVE-2023-6345 NVD : 9.6...

SUSE-SU-2023:4561-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.42.2 bsc1217210: - CVE-2023-41983: Processing web content may lead to a denial-of-service. - CVE-2023-42852: Processing web content may lead to arbitrary code execution. Already previously fixed: - CVE-2022-32919: Visitin...

Nextcloud Server < 22.2.10.16, 23.x < 23.0.12.11, 24.x <24.0.12.7, 25.x < 25.0.11, 26.x < 26.0.6, 27.x < 27.1.0 Multiple Vulnerabilities (GHSA-8JWV-C8C8-9FR3, GHSA-8F69-F9JG-4X3V)

Nextcloud Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nextcloud:nextcloudserver"...

PT-2023-32525 · M Files · M-Files Server

Name of the Vulnerable Software and Affected Versions: M-Files server versions prior to 23.11.13156.0 Description: A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server, which allows attackers to execute...

PT-2023-32059 · WordPress · Five Star Restaurant Menu/Food Ordering

Name of the Vulnerable Software and Affected Versions: Five Star Restaurant Menu and Food Ordering WordPress plugin versions prior to 2.4.11 Description: The issue allows unauthenticated users to perform PHP Object Injection via an AJAX action by unserializing user input. This can be exploited wh...

samba security, bug fix, and enhancement update

evolution-mapi 3.28.3-8 - Related: 2190417 - Rebuild for samba rebase to 4.18.x openchange 2.3-32.0.1 - Use ldconfigscriptlets 2.3-32 - Related: 2190417 Rebuild for samba rebase to 4.18.x samba 4.18.6-1 - related: rhbz2190417 - Update to version 4.18.6 - resolves: rhbz2232564 - Fix the rpc...

CVE-2023-6179

Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folders. An attacker could potentially exploit this vulnerability, leading to a standard user to have arbitrary system code execution. Honeywell recommends updating to the most...

PT-2023-22175 · Intel · Intel Ofu

Name of the Vulnerable Software and Affected Versions: IntelR OFU software versions prior to 14.1.31 Description: The issue is related to improper access control in IntelR OFU software, which may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2023-22179 · Intel · Intel Ofu

Name of the Vulnerable Software and Affected Versions: IntelR OFU software versions prior to 14.1.31 Description: The issue is related to an uncontrolled search path in some IntelR OFU software, which may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2023-6888 · WordPress · Wp Fastest Cache

Name of the Vulnerable Software and Affected Versions: WP Fastest Cache versions prior to 1.2.2 Description: The issue is related to the WP Fastest Cache WordPress plugin, which does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection...

PT-2023-25681 · Michael Mann · Simple Site Verify Plugin

Name of the Vulnerable Software and Affected Versions: Michael Mann Simple Site Verify plugin versions 1.0.7 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions 1.0.7 an...

PT-2023-23834 · Xtemos · Woodmart - Multipurpose Woocommerce Theme

Name of the Vulnerable Software and Affected Versions: xtemos WoodMart - Multipurpose WooCommerce Theme versions = 7.1.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that...

PT-2023-28422 · Samsung · Samsung Pass

Name of the Vulnerable Software and Affected Versions: Samsung Pass versions prior to 4.3.00.17 Description: The issue allows physical attackers to bypass authentication due to an improper authentication mechanism. Recommendations: For versions prior to 4.3.00.17, update to version 4.3.00.17 or...

Citrix Endpoint Management (aka XenMobile Server) 10.15.0 Rolling Patch 5

Package name: xms10.15.0.10517.bin For: XenMobile Server 10.15.0 Deployment type: On-premises only Replaces: xms10.15.0.10417.bin, xms10.15.0.10327.bin, xms10.15.0.10220.bin and xms10.15.0.10125.bin Date: November 2023 Languages supported: English US Important notes about this update As a best...

PT-2023-27538 · Unknown · Contact Form 7 Custom Validation

Name of the Vulnerable Software and Affected Versions: Contact form 7 Custom validation versions n/a through 1.1.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...