CVE-2023-32308 SQL Injection Vulnerability in anuko timetracker

anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for error...

SUSE: Security Advisory (SUSE-SU-2023:2187-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-21702 · Apexchat · Apexchat

Name of the Vulnerable Software and Affected Versions: ApexChat plugin versions = 1.3.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For ApexChat plugin versions = 1.3.1, update to a...

Boxo bitswap/server: DOS unbounded persistent memory leak

Impact An attacker is able allocate arbitrarily many bytes in the Bitswap server by sending many WANTBLOCK and or WANTHAVE requests which are queued in an unbounded queue, with allocations that persist even if the connection is closed. This affects users accepting untrusted connections with the...

PT-2023-22194 · Vitess +2 · Vitess +2

Name of the Vulnerable Software and Affected Versions: Vitess versions prior to 16.0.2 Description: The issue allows users to create a shard containing / characters from VTAdmin, which can cause errors when trying to create new shards or view keyspaces. Creating a shard using vtctldclient does no...

CVE-2023-32070 Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting XSS attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. Ther...

Multiple vulnerabilities in MicroEngine Mailform

Overview MicroEngine Mailform provided by MicroEngine Inc. contains multiple vulnerabilities listed below. Unrestricted upload of file with dangerous type CWE-434 - CVE-2023-27397 Path traversal CWE-22 - CVE-2023-27507 Yuji Tounai of Mitsui Bussan Secure Directions, Inc. and hibiki moriyama of...

PT-2023-14015 · Intel · Intel Retail Edge Mobile Ios

Name of the Vulnerable Software and Affected Versions: IntelR Retail Edge Mobile iOS application versions prior to 3.4.7 Description: The issue is related to improper access control, which may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2023-18406 · Intel · Intel Server Board Bmc Firmware

Name of the Vulnerable Software and Affected Versions: IntelR Server Board BMC firmware versions prior to 2.90 Description: The issue allows a privileged user to enable escalation of privilege via local access due to access of memory location after end of buffer in the firmware. Recommendations:...

PT-2023-14001 · Intel · Intel Qat Drivers

Name of the Vulnerable Software and Affected Versions: IntelR QAT drivers for Windows versions prior to 1.9.0 Description: The issue is related to improper access control in IntelR QAT drivers for Windows, which may allow an authenticated user to potentially enable information disclosure via loca...

PT-2023-14059 · Intel · Intel Dcm

Name of the Vulnerable Software and Affected Versions: IntelR DCM software versions prior to 5.1 Description: The issue is related to an uncontrolled search path in the IntelR DCM software, which may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2023-14016 · Intel · Intel Quartus Prime Pro

Name of the Vulnerable Software and Affected Versions: IntelR QuartusR Prime Pro edition software versions prior to 22.3 Description: The issue is related to an uncontrolled search path in the software, which may allow an authenticated user to potentially enable escalation of privilege via local...

PT-2023-19294 · Intel · Intel Trace Analyzer/Collector

Name of the Vulnerable Software and Affected Versions: IntelR Trace Analyzer and Collector software versions prior to 2021.8.0 Description: The issue is related to an out-of-bounds read that may allow an authenticated user to potentially enable information disclosure via local access...

PT-2023-21395 · Unknown · Liquid Speech Balloon

Name of the Vulnerable Software and Affected Versions: LIQUID SPEECH BALLOON versions prior to 1.2 Description: A cross-site request forgery CSRF issue allows a remote unauthenticated attacker to hijack the authentication of a user and perform unintended operations by having a user view a malicio...

Node.js: Regular Expression Denial of Service in Headers fetch API

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set and Headers.append methods are vulnerable to Regular Expression Denial of Service ReDoS attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normali...

PT-2023-7428 · Intel · Intel Nuc P14E Laptop Element

Name of the Vulnerable Software and Affected Versions: Intel NUC P14E Laptop Element software versions prior to 1.0.0.156 Description: The issue is related to incorrectly used default permissions in the Audio Service of the Intel NUC P14E Laptop Element software. This could allow an authenticated...

PT-2025-25214

Name of the Vulnerable Software and Affected Versions Perl CryptX versions prior to 0.087 Description The issue is related to an integer overflow associated with a dependency in the libtommath library embedded in Perl CryptX. This library is susceptible to an integer overflow. Recommendations For...

PT-2023-22946 · Sap · Sap Crm +1

Name of the Vulnerable Software and Affected Versions: SAP CRM WebClient UI versions S4FND 102 through S4FND 107, WEBCUIF 700 through WEBCUIF 801 Description: The issue arises from insufficient encoding of user-controlled inputs, leading to a stored Cross-Site Scripting XSS vulnerability. An...

PT-2025-25912 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.4.0-1086-azure 9118.04.1-Ubuntu Description: The issue is related to the storvsc error wq workqueue in the Linux kernel, which was incorrectly marked as WQ MEM RECLAIM. This marking may cause a deadlock while...

PT-2025-25955 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.18.0-rc4 Description: The issue arises when the USB sleep clocks are disabled, and the clock framework attempts to disable the sleep clock source as well. However, this source cannot be disabled, resulting in ...