PT-2023-31023 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: anything-llm version prior to 0.0.1 Description: The issue is related to an Authentication Bypass by Primary Weakness in the GitHub repository mintplex-labs/anything-llm. Recommendations: For versions prior to 0.0.1, update to version 0.0.1 o...

PT-2023-28303 · Unknown · Jeecg-Boot

Name of the Vulnerable Software and Affected Versions: Jeecg boot versions up to 3.5.3 Description: A SQL injection vulnerability was discovered in Jeecg boot via the component "/jeecg-boot/jmreport/show". This issue allows for SQL injection attacks, potentially leading to unauthorized access to...

Important: python3.11

Issue Overview: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer...

OPENSUSE-SU-2023:0244-1 Security update for chromium

This update for chromium fixes the following issues: Update to version 116.0.5845.140 boo1214758: CVE-2023-4572: Use after free in MediaStream...

PT-2023-30712 · Answerdev · Answer

Name of the Vulnerable Software and Affected Versions: answerdev/answer versions prior to v1.1.3 Description: The issue is related to missing authentication for a critical function in the GitHub repository answerdev/answer. This could potentially allow unauthorized access to sensitive data or...

protobuf-java: timeout in parser leads to DoS

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted...

PT-2023-25459

Name of the Vulnerable Software and Affected Versions Mava Software Hotel Management System versions prior to 2.0 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-36254 · Google +1 · Go +1

Name of the Vulnerable Software and Affected Versions: amazon-ecs-init affected versions not specified Description: The issue is related to a security release in the Go programming language, version 1.21. The update of amazon-ecs-init is intended to address this issue by rebuilding the package wi...

PT-2023-4997 · Aruba · Aruba Airwave

Name of the Vulnerable Software and Affected Versions: Aruba AirWave versions prior to 8.0.7 Description: The issue allows for cross-site scripting XSS attacks against an administrator. This is due to a lack of protection measures for the web page structure, which can be exploited by a remote...

PT-2023-26517 · Unknown · Vi Web Client

Name of the Vulnerable Software and Affected Versions: VI Web Client versions prior to 7.9.6 Description: The issue allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL. This can lead to users being redirected t...

PT-2023-25124 · Unknown · Bma Personnel Tracking System

Name of the Vulnerable Software and Affected Versions: BMA Personnel Tracking System versions before 20230904 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. The...

CVE-2023-41057

Hyper-bump-it contains a Path Traversal vulnerability due to not checking that the globbed files reside under the project root. The code joins project root with a config-supplied string to build the target path, which can cause edits to files outside the project. The issue is fixed in release v0....

Hyper Bump It Path Traversal Vulnerability

Hyper Bump It is a command line tool used to update the version in the project file required for the next release. A path traversal vulnerability exists in versions of Hyper Bump It prior to 0.5.1, which stems from not checking files in the project root directory...

PT-2023-28406 · WordPress · Ai Chatbot

Name of the Vulnerable Software and Affected Versions: AI ChatBot WordPress plugin versions prior to 4.7.8 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

PT-2023-19188 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.10.0 Description: An authorization/sensitive information disclosure issue was identified in GitHub Enterprise Server, allowing a fork to retain read access to an upstream repository after its...

PT-2023-26164 · Unknown · Chop-Chop Coming Soon Chop Chop

Name of the Vulnerable Software and Affected Versions: Chop-Chop Coming Soon Chop Chop plugin versions 2.2.4 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-20095 · WordPress · Yotuwp Video Gallery

Name of the Vulnerable Software and Affected Versions: Yotuwp Video Gallery plugin versions prior to 1.3.13 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Yotuwp Video Gallery plugin...

Design/Logic Flaw

Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for outgoing DNS queries and while that socket is bound to a random port number it is never changed again. This goes against recommended practice sin...

PT-2023-21977 · Zscaler · Zscaler Admin Ui

Name of the Vulnerable Software and Affected Versions: Zscaler Admin UI versions 6.2 before 6.2r Description: The issue is related to an improper verification of cryptographic signature in the SAML authentication of the Zscaler Admin UI, allowing a privilege escalation. Recommendations: For...

PT-2023-30069 · Instantsoft · Icms2

Name of the Vulnerable Software and Affected Versions: instantsoft/icms2 versions prior to 2.16.1-git Description: The issue is related to Cross-site Scripting XSS - Stored. This means that an attacker can inject malicious scripts into a website, which are then stored on the server and executed b...