PT-2023-22083 · Cakephp +2 · Cakephp +2

Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 4.8.0 Description: The issue is a XSS Vulnerability in the Favorites Feature of baserCMS, a website development framework that runs on PHP8 and CakePHP4. This vulnerability allows malicious code to be executed in th...

CVE-2023-41721

Instances of UniFi Network Application that i are run on a UniFi Gateway Console, and ii are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to t...

CVE-2023-41721

Instances of UniFi Network Application that i are run on a UniFi Gateway Console, and ii are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to t...

PT-2023-29679 · WordPress · Gopi Ramasamy Scroll Post Excerpt Plugin

Name of the Vulnerable Software and Affected Versions: Gopi Ramasamy Scroll post excerpt plugin versions = 8.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This type of vulnerability allows an attacker to inject...

PT-2023-23397 · Dromara · Dromara Sureness

Name of the Vulnerable Software and Affected Versions: Dromara Sureness versions prior to 1.0.8 Description: The issue is related to the use of a hardcoded key in Dromara Sureness. Recommendations: For versions prior to 1.0.8, update to version 1.0.8 or later to resolve the issue...

PT-2023-28678 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions prior to 5.3 Description: The issue is related to an XML External Entity injection vulnerability. This could potentially be exploited by an XXE attack, which may disclose local files in the file system. Recommendations: Fo...

PT-2023-29838 · Userback · Userback

Name of the Vulnerable Software and Affected Versions: Userback plugin versions 1.0.13 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

PT-2023-6348

Name of the Vulnerable Software and Affected Versions VMware Workstation versions prior to 17.5 and VMware Fusion versions prior to 13.5 Description A flaw exists in the functionality for sharing host Bluetooth devices with virtual machines in VMware Workstation and VMware Fusion. This issue...

PT-2023-29943 · Nagvis +1 · Nagvis +1

Name of the Vulnerable Software and Affected Versions: NagVis versions prior to 1.9.38 Description: The issue exists due to a cross-site scripting XSS flaw in the select function located in share/server/core/functions/html.php. This allows for potential XSS attacks. Recommendations: For versions...

Important: Red Hat Bug Fix Advisory: Red Hat Integration - Service Registry 2.4.4 SP1 OpenShift images

2.4.4 SP1 release of Red Hat Integration - Service Registry. This advisory makes available an update to the Red Hat Integration - Service Registry images...

SUSE-SU-2023:4109-1 Security update for erlang

This update for erlang fixes the following issues: - Updated to version 23.3.4.19 jscPED-6209: - CVE-2022-37026: Complete a previous insufficient fix for an authentication bypass bsc1205318...

PT-2023-23598 · Pegasystems · Pega Platform

Name of the Vulnerable Software and Affected Versions: Pega Platform versions 8.1 to 8.8.2 Description: The issue is an XSS problem related to Pin description. Recommendations: For Pega Platform versions 8.1 to 8.8.2, update to a version that includes a fix for the XSS issue. At the moment, there...

PT-2023-29344 · WordPress · Arrow Plugins Social Feed | Custom Feed For Social Media Networks

Name of the Vulnerable Software and Affected Versions: Arrow Plugins Social Feed | Custom Feed for Social Media Networks plugin versions = 2.2.0 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. No information is provided about the estimated number of...

PT-2023-29334 · WordPress · Realmag777 Wolf – Wordpress Posts Bulk Editor/Manager Professional

Name of the Vulnerable Software and Affected Versions: realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin versions 1.0.7.1 and earlier Description: The issue is related to an Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability. This means that an attacker...

PT-2023-6294 · Oracle · Oracle Database Recovery Manager +2

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.20 Oracle Database Server versions 21.3 through 21.11 Description: The issue is related to insufficient input validation in the Oracle Database Recovery Manager component. This allows a...

PT-2023-29346 · Castos · Castos Seriously Simple Stats Plugin

Name of the Vulnerable Software and Affected Versions: Castos Seriously Simple Stats plugin versions = 1.5.1 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

PT-2023-6273 · Oracle · Oracle Http Server

Name of the Vulnerable Software and Affected Versions: Oracle HTTP Server version 12.2.1.4.0 Description: The issue is related to a lack of protection for service data in the Web Listener component of Oracle HTTP Server. This allows an unauthenticated attacker with network access via HTTP to...

CVE-2023-45147 Arbitrary keys can be added to a topic's custom fields by any user in Discourse

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation...

PT-2023-29818 · Codedrafty · Codedrafty Mediabay – Media Library Folders

Name of the Vulnerable Software and Affected Versions: Codedrafty Mediabay – Media Library Folders plugin versions 1.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated users with editor or higher privileges. This...

PT-2023-30025 · WordPress · Enable Media Replace

Name of the Vulnerable Software and Affected Versions: Enable Media Replace WordPress plugin versions prior to 4.1.3 Description: The issue allows Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog, due to the unserialize of user input via the Remove...