PT-2023-22787 · Yfcmf · Yfcmf

Name of the Vulnerable Software and Affected Versions: YFCMF versions up to 3.0.4 Description: A vulnerability has been found that affects unknown code in the file index.php, leading to path traversal. The manipulation can be initiated remotely, using '../filedir' to traverse paths. The exploit h...

PT-2023-32972 · Unknown · Pocketmine-Mp

Name of the Vulnerable Software and Affected Versions: PocketMine-MP versions prior to 4.18.0-ALPHA2 Description: The issue arises from the client sending a "mismatch" type InventoryTransactionPacket to request a resync of all currently open inventories. Since PocketMine-MP does not rate-limit...

PT-2023-24607 · Deno · Eden Runtime +1

Name of the Vulnerable Software and Affected Versions: Deno versions 1.34.0 deno runtime versions 0.114.0 Description: The issue affects outbound HTTP requests made using the built-in node:http or node:https modules, which are incorrectly not checked against the network permission allow list...

SUSE-SU-2023:2312-1 Security update for go1.18-openssl

This update for go1.18-openssl fixes the following issues: - Add subpackage go1.x-libstd compiled shared object libstd.so jscPED-1962 Main go1.x package included libstd.so in previous versions Split libstd.so into subpackage that can be installed standalone Continues the slimming down of main go1...

PT-2023-36185 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security release in Go 1.19. The terraform-provider-helm package has been rebuilt with this security release to address the issue. Recommendations:...

PT-2023-14033 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.8 MediaWiki versions 1.36.x through 1.37.4 MediaWiki versions 1.38.x through 1.38.2 Description: An issue was discovered in MediaWiki where the alreadyrolled message can leak a user name upon an action=rollbac...

PT-2023-24301 · WordPress · Woocommerce Product Vendors

Name of the Vulnerable Software and Affected Versions: WooCommerce Product Vendors plugin versions = 2.1.76 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowi...

PT-2023-13479 · Unknown · Metagauss Download Plugin

Name of the Vulnerable Software and Affected Versions: Metagauss Download Plugin versions = 2.0.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-18638 · Conlabzgmbh · Conlabzgmbh Wp Google Tag Manager

Name of the Vulnerable Software and Affected Versions: conlabzgmbh WP Google Tag Manager plugin versions = 1.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on ...

PT-2023-15081 · WordPress · Orion Woocommerce Products Designer

Name of the Vulnerable Software and Affected Versions: ORION Woocommerce Products Designer plugin versions = 4.3.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a we...

PT-2023-15044 · WordPress · Litespeed Cache

Name of the Vulnerable Software and Affected Versions: LiteSpeed Cache plugin versions prior to 5.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

Image Builder security, bug fix, and enhancement update

cockpit-composer 45-1.0.1 - Make per page documentation links point to Oracle Linux Orabug: 32013095 45-1 - New upstream release 44-1 - New upstream release 43-1 - New upstream release 42-1 - New upstream release 40-1 - New upstream release 39-1 - New upstream release 38-1 - New upstream release...

PT-2023-21175 · Unknown · Cityboss E-Municipality

Name of the Vulnerable Software and Affected Versions: Cityboss E-municipality versions prior to 6.05 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-15076 · WordPress · Brainstorm Force Starter Templates

Name of the Vulnerable Software and Affected Versions: Brainstorm Force Starter Templates plugin versions = 3.1.20 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions...

PT-2023-21183 · Unknown · Solarview Compact Sv-Cpt-Mc310

Name of the Vulnerable Software and Affected Versions: SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 SolarView Compact SV-CPT-MC310F versions prior to Ver.8.10 Description: The issue is related to the use of hard-coded credentials, which may allow a remote authenticated attacker to lo...

PT-2023-20903

Name of the Vulnerable Software and Affected Versions Competition Management System versions prior to 23.07 Description The issue allows for authentication abuse and bypass through an authorization bypass vulnerability. This is due to a user-controlled key in the Finex Media Competition Managemen...

PT-2023-19152 · WordPress · User Meta Manager

Name of the Vulnerable Software and Affected Versions: User Meta Manager plugin versions = 3.4.9 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-15210 · Aram Kocharyan · Crayon Syntax Highlighter

Name of the Vulnerable Software and Affected Versions: Aram Kocharyan Crayon Syntax Highlighter plugin versions = 2.8.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-20972 · WordPress · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg plugin for WordPress versions up to, and including, 2.7.9.8 Description: The issue is related to a missing capability check on the check license functions, allowing authenticated attackers with subscriber-level permissions and abov...

PT-2023-21073 · WordPress · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg plugin for WordPress versions up to, and including, 2.7.9.8 Description: The issue is related to Stored Cross-Site Scripting via the 'gh form' shortcode due to insufficient input sanitization and output escaping on user-supplied...