CVE-2023-28448 Versionize is lacking bound checks, potentially leading to out of bounds memory access

Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for...

SUSE-SU-2023:1571-1 Security update for helm

This update for helm fixes the following issues: Update to version 3.11.1 bsc1208084: - CVE-2023-25165: Fixed a information disclosure problem via getHostByName injection inside a chart to get values to a malicious DNS server...

PT-2023-21720 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: Dataease versions prior to 1.18.5 Description: Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. Recommendations: For versions prior to 1.18.5, update to version...

CVE-2023-28441 smartCARS 3 Password Stored as plain text in Error Log

smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs. This problem doesn't occur in version 0.5.9. As a workaround, delete the affected log file, and ensure one logs in correctly...

PT-2023-19264 · WordPress · Michael Aronoff Very Simple Google Maps

Name of the Vulnerable Software and Affected Versions: Michael Aronoff Very Simple Google Maps plugin versions 2.8.4 and earlier Description: The issue is related to a Cross-Site Scripting XSS vulnerability that affects authenticated users with contributor or higher permissions. This vulnerabilit...

PT-2023-21893 · Jenkins · Jenkins Octoperf Load Testing Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OctoPerf Load Testing Plugin Plugin versions 4.5.1 and earlier Description: The issue allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through...

PT-2023-16719 · Unknown · Koc Energy Web Report System

Name of the Vulnerable Software and Affected Versions: As Koc Energy Web Report System versions prior to 23.03.10 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. Recommendations: For...

PT-2023-21885 · WordPress · Formidable Pro2Pdf Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Formidable PRO2PDF WordPress Plugin versions prior to 3.11 Description: The issue is an authenticated SQL injection vulnerability. It affects the fieldmap parameter in the fpropdf export file action. Recommendations: For versions prior to 3.1...

Medium: git

Issue Overview: Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git...

PT-2023-21881

Name of the Vulnerable Software and Affected Versions The Waiting: One-click Countdowns WordPress Plugin version = 0.6.2 Description The issue is an authenticated SQL injection vulnerability. It affects the pbc downmetaid parameter of the pbc save downs action. Recommendations For versions = 0.6....

Medium: python-twisted

Issue Overview: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowi...

Critical: clamav

Issue Overview: Possible remote code execution vulnerability in the ClamAV HFS+ file parser. The issue affects ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. CVE-2023-20032 A possible remote information leak vulnerability in the DMG file parser. The issue affects...

PT-2023-2188 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 Description: The issue is related to a deserialization vulnerability in the Device-DataCollect service, which could allow deserialization of requests prior to authentication,...

PT-2023-21386 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex version 4.4.2 Description: The issue allows a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. Recommendations: For IBM Aspera Faspex version 4.4.2, update to a...

PT-2023-2322 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 Description: The issue is related to improper access control, which could allow an attacker to retrieve Gateway configuration files and obtain plaintext credentials. This coul...

CVE-2023-1539 Improper Restriction of Excessive Authentication Attempts in answerdev/answer

Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6...

PT-2023-14037 · Unknown · Galleryape Gallery Images Ape

Name of the Vulnerable Software and Affected Versions: Galleryape Gallery Images Ape plugin versions = 2.2.8 Description: The issue is related to a Stored Cross-Site Scripting vulnerability that affects users with contributor or higher permissions. Recommendations: For Galleryape Gallery Images A...

PT-2023-2320 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 Description: The issue is related to errors in code generation, allowing an attacker to remotely execute arbitrary code by running Lua scripts. This could enable an attacker t...

CVE-2023-0681 Rapid7 Nexpose Uncontrolled URL Redirect

Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’ parameter of the ‘data/console/redirect’ component of the application. This issue was resolved in t...

PT-2025-18821 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.2.0 Description: A global-out-of-bounds issue has been identified in the Linux kernel's Bluetooth HCI component. The hci init stage sync function fails to properly validate the stage array, leading to potentia...