PT-2023-29581 · Omeka-S · Omeka-S

Name of the Vulnerable Software and Affected Versions: omeka/omeka-s versions prior to 4.0.4 Description: The issue is related to improper authorization of an index containing sensitive information in the omeka/omeka-s GitHub repository. Recommendations: For versions prior to 4.0.4, update to...

PT-2023-27516 · Unknown · Weblogic-Framework

Name of the Vulnerable Software and Affected Versions: weblogic-framework versions 0.2.3 and prior Description: The issue is related to a deserialization vulnerability that may lead to remote code execution. When the weblogic-framework receives the command echo, it directly deserializes the data...

PT-2023-27311 · Unknown · Silverware Games

Name of the Vulnerable Software and Affected Versions: Silverware Games versions prior to 1.3.7 Description: The issue concerns a timing difference in the Recovery form of Silverware Games, a premium social network for online gaming, which can indicate whether a specified email address is present...

PT-2023-4584 · Qnap · Qnap Qts +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.0.1.2425 build 20230609 QNAP QTS versions prior to 5.1.0.2444 build 20230629 QNAP QuTS hero h5.1.0 versions prior to 2424 build 20230609 Description: A cleartext transmission of sensitive information issue has bee...

PT-2023-4809 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.9 XWiki Platform versions prior to 15.4RC1 Description: The create action in XWiki Platform is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with...

SUSE-SU-2023:3379-1 Security update for nodejs16

This update for nodejs16 fixes the following issues: Update to LTS version 16.20.2. - CVE-2023-32002: Fixed permissions policies bypass via Module.load bsc1214150. - CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire bsc1214156. - CVE-2023-32559: Fixed...

Adobe Acrobat Classic 2020 Security Update (APSB23-30) - Windows

Adobe Acrobat is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:acrobatdcclassic";...

PT-2023-19664 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions prior to 7.67 Description: The issue allows an attacker to execute arbitrary system commands by exploiting an unrestricted file upload vulnerability in the Pandora FMS File Manager component. Recommendations: For versions...

PT-2023-18871 · Typora · Typora

Name of the Vulnerable Software and Affected Versions: Typora versions prior to 1.6.7 Description: The issue allows a crafted markdown file to run arbitrary JavaScript code in the context of Typora's main window via loading typora://app/typemark/updater/update.html in an tag. This can be exploite...

PT-2023-23617 · Ays · Photo Gallery Team Photo Gallery

Name of the Vulnerable Software and Affected Versions: Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin versions = 5.1.3 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject...

PT-2023-22366 · Typora · Typora

Name of the Vulnerable Software and Affected Versions: Typora versions prior to 1.7.0-dev Description: The issue is related to improper path handling, which allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This can be exploited...

SUSE-SU-2023:3345-1 Security update for postgresql15

This update for postgresql15 fixes the following issues: - Update to 13.12 - CVE-2023-39417: Fixed potential SQL injection for trusted extensions. bsc1214059...

SUSE-SU-2023:3344-2 Security update for postgresql15

This update for postgresql15 fixes the following issues: - Update to 13.12 - CVE-2023-39417: Fixed potential SQL injection for trusted extensions. bsc1214059...

PT-2023-18557 · WordPress · Ko-Fi Button

Name of the Vulnerable Software and Affected Versions: Ko-fi Button WordPress plugin versions prior to 1.3.3 Description: The issue concerns the Ko-fi Button WordPress plugin, which does not properly handle some of its settings. This could allow high-privilege users to perform Stored Cross-Site...

PT-2023-28732 · Cockpit · Cockpit

Name of the Vulnerable Software and Affected Versions: cockpit versions prior to 2.4.3 Description: The issue is related to Cross-site Scripting XSS - Stored in the GitHub repository cockpit-hq/cockpit. This type of attack occurs when an application stores user input and later displays it without...

PT-2023-19056 · Ite Tech · Ite Tech Consumer Infrared Driver

Name of the Vulnerable Software and Affected Versions: ITE Tech consumer infrared drivers versions prior to 5.5.2.1 for IntelR NUC Description: The issue is related to an uncontrolled search path element in some ITE Tech consumer infrared drivers for IntelR NUC, which may allow an authenticated...

PT-2023-12127 · Xnview · Xnview

Name of the Vulnerable Software and Affected Versions: XNView version 2.49.3 Description: The issue allows local attackers to execute arbitrary code via a crafted TIFF file. This is a Buffer Overflow vulnerability. Recommendations: For XNView version 2.49.3, update to a version that fixes this...

PT-2023-23868 · Intel · Mavinci Desktop

Name of the Vulnerable Software and Affected Versions: MAVinci Desktop Software for IntelR Falcon 8+ versions prior to 6.2 Description: The issue is related to incorrect default permissions in the software, which may allow an authenticated user to potentially enable escalation of privilege via...

PT-2023-23878 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.1.236 Description: The issue concerns XML External Entity Processing in the decodeToMap function of Ivanti Avalanche, which can lead to information disclosure. Recommendations: For versions prior to...

Nextcloud Server Multiple Vulnerabilities (GHSA-vv27-g2hq-v48h, GHSA-g97r-8ffm-hfpj, GHSA-qhgm-w4gx-gvgp, GHSA-xwxx-2752-w3xm, GHSA-j4qm-5q5x-54m5)

Nextcloud Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nextcloud:nextcloudserver"...