CVE-2023-23591

The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging is enabled. The fixed versions are 8.2.18.7, 8.2.18.2.2, 8.3.11.1, and 8.3.14.1...

PT-2023-11730 · Sqlite3 +4 · Sqlite3 +4

Name of the Vulnerable Software and Affected Versions: SQLite3 versions 3.27.1 and earlier Description: A Buffer Overflow issue allows a local attacker to cause a denial of service via a crafted script. This issue can be exploited to disrupt service. Recommendations: For SQLite3 versions 3.27.1 a...

PT-2023-16260 · WordPress · Article Directory Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Article Directory WordPress plugin versions prior to 1.4 Description: The issue arises from improper sanitization of the publish terms text setting, which can be exploited to conduct Stored XSS attacks, particularly in multisite environments...

PT-2023-16261 · WordPress · Wordpress Amazon S3 Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Amazon S3 Plugin versions prior to 1.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2023-20269 · Unknown · Gqevu6Bsiz Announce From The Dashboard

Name of the Vulnerable Software and Affected Versions: gqevu6bsiz Announce from the Dashboard plugin versions = 1.5.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to inject malicious scripts into the website, which can...

PT-2023-19877 · Kiboko · Kiboko Labs Chained Quiz Plugin

Name of the Vulnerable Software and Affected Versions: Kiboko Labs Chained Quiz plugin versions prior to 1.3.2.6 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to 1.3.2.6...

PT-2023-19336 · WordPress · Wpgear.Pro Wpfrom Email

Name of the Vulnerable Software and Affected Versions: WPGear.Pro WPFrom Email plugin versions 1.8.8 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the WPGear.Pro WPFrom Email plugin. This vulnerability requires authentication with...

PT-2023-19285 · Oceanwp · Oceanwp Ocean Extra +1

Name of the Vulnerable Software and Affected Versions: OceanWP Ocean Extra plugin versions = 2.1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with contributor or higher privileges. It affects the OceanWP Ocean Extra plugin whe...

PT-2023-22243 · Bzip3 · Bzip3

Name of the Vulnerable Software and Affected Versions: bzip3 versions prior to 1.3.0 Description: An issue was discovered in libbzip3.a in bzip3. A denial of service process hang can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais...

CVE-2023-1412

An unprivileged non-admin user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows = 2022.12.582.0 to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks oplock and symbolic links which can both be creat...

CVE-2023-1412

An unprivileged non-admin user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows = 2022.12.582.0 to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks oplock and symbolic links which can both be creat...

PT-2023-17312 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue is related to Cross-site Scripting XSS due to the failure to sanitize user input in the stopword parameter. This allows for potential exploitation. The estimated number of...

PT-2023-14003 · Peepso · Peepso Community

Name of the Vulnerable Software and Affected Versions: PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin versions = 6.0.2.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing...

PT-2023-16209 · Helpy · Helpy

Name of the Vulnerable Software and Affected Versions: Helpy version 2.8.0 Description: The issue allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the attachments sent by customers in the...

CVE-2023-28854 nophp vulnerable to shell command injection on httpd user when sending a password-setting mail or mail-login mail

nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409aa2d441789cbb35f6b119bef97ecc3986aa on 2023-03-30. Users should update index.php to 2023-03-30 or later or, as a workaround, add a function...

PT-2023-9329

Name of the Vulnerable Software and Affected Versions mod auth openidc versions 2.0.0 through 2.4.13.1 Description The issue is related to the mod auth openidc module for the Apache 2.x HTTP server, which implements OpenID Connect Relying Party functionality. When OIDCStripCookies is set and a...

PT-2023-20704 · Dupeoff.Com · Dupeoff

Name of the Vulnerable Software and Affected Versions: DupeOff.Com DupeOff plugin versions 1.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For DupeOff.Com DupeOff plugin...

PT-2023-21997 · Wagtail · Wagtail

Name of the Vulnerable Software and Affected Versions: Wagtail versions 1.5 through 4.1.3 Wagtail versions 1.5 through 4.2.1 Description: A stored cross-site scripting XSS vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account...

PT-2023-17247 · Unknown · Firefly-Iii

Name of the Vulnerable Software and Affected Versions: firefly-iii/firefly-iii versions prior to 6.0.0 Description: The issue is related to improper input validation in the firefly-iii/firefly-iii GitHub repository. Recommendations: For versions prior to 6.0.0, update to version 6.0.0 or later to...

PT-2023-17222 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue concerns improper privilege management, allowing any user who can add a new user to create a user with super admin rights. This has been fixed in version 3.1.12. Recommendation...