PT-2023-14436 · Bulutses Information Technologies · Bulutses Call Center System

Name of the Vulnerable Software and Affected Versions: Bulutses Information Technologies Call Center System versions prior to 3.0 Description: The issue is related to an unauthenticated Sql Injection vulnerability. This vulnerability has been fixed in version 3.0. Recommendations: For versions...

CVE-2022-38489

An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting XSS. Version 2022.1.110.1.02 fixes the vulnerably...

PT-2023-1428 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 16.1.x beginning in 16.1.2.2 to before 16.1.3.3 BIG-IP versions 17.0.x before 17.0.0.2 Description: The issue is related to the implementation of the HTTP Profile configuration on a virtual server in BIG-IP, which can cause th...

PT-2023-14438 · WordPress · Mautic Integration For Woocommerce

Name of the Vulnerable Software and Affected Versions: Mautic Integration for WooCommerce WordPress plugin versions prior to 1.0.3 Description: The issue is related to a lack of proper CSRF check when updating settings, and the failure to ensure that the options to be updated belong to the plugin...

PT-2023-13349 · WordPress · Wptouch

Name of the Vulnerable Software and Affected Versions: WPtouch WordPress plugin versions prior to 4.3.45 Description: The issue allows high privilege users, such as admins, to upload arbitrary files on the server, even when they should not be allowed to, for example in a multisite setup. This is...

PT-2023-14239 · Aruba · Aruba Edgeconnect Enterprise Orchestrator

Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise Orchestrator versions 9.2.1.40179 and below Aruba EdgeConnect Enterprise Orchestrator versions 9.1.4.40436 and below Aruba EdgeConnect Enterprise Orchestrator versions 9.0.7.40110 and below Aruba EdgeConnect...

PT-2023-14112 · Ibm · Ibm Business Automation Workflow

Name of the Vulnerable Software and Affected Versions: IBM Business Automation Workflow versions 18.0.0 through 22.0.1 Description: The issue allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts due to cross-site request forgery...

PT-2023-14287 · WordPress · Wp-Lister Lite For Amazon

Name of the Vulnerable Software and Affected Versions: WP-Lister Lite for Amazon WordPress plugin versions prior to 2.4.4 Description: The issue is related to a Reflected Cross-Site Scripting that can be used against high-privilege users such as admin. This occurs because the plugin does not...

PT-2023-14167 · WordPress · Wholesale Market

Name of the Vulnerable Software and Affected Versions: Wholesale Market WordPress plugin versions prior to 2.2.1 Description: The issue allows unauthenticated attackers to download arbitrary files from the server due to the lack of authorization checks and validation of user input used to generat...

PT-2023-14170 · WordPress · White Label Cms

Name of the Vulnerable Software and Affected Versions: White Label CMS WordPress plugin versions prior to 2.5 Description: The issue allows high-privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present. This is due to the plugin unserializing user input...

PT-2022-28128 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue is related to Cross-site Scripting XSS - Stored in the GitHub repository usememos/memos. This type of attack occurs when an application includes user input in its output without...

CVE-2022-46174 Race condition during concurrent TLS mounts in efs-utils

efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to mount file systems, the mount helper allocates a local port for stunnel to receive NFS...

PT-2022-26190 · Dragonfly · Dragonfly

Name of the Vulnerable Software and Affected Versions: Dragonfly version 0.3.0-SNAPSHOT Description: The issue concerns a Java runtime dependency management library that does not configure DocumentBuilderFactory to prevent XML external entity XXE attacks. This can be avoided by not trying to...

PT-2022-26341 · WordPress · Simple Basic Contact Form

Name of the Vulnerable Software and Affected Versions: Simple Basic Contact Form WordPress plugin versions prior to 20221201 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed,...

PT-2022-25906 · WordPress · Contest Gallery Pro +1

Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 19.1.5 Contest Gallery Pro WordPress plugin versions prior to 19.1.5 Description: The issue allows malicious users with at least author privilege to leak sensitive information from the site's...

PT-2022-27203 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: Snipe-IT versions prior to 6.0.14 Description: The issue is related to Cross Site Scripting XSS for View Assigned Assets. This means an attacker could potentially inject malicious scripts into the website, which would then be executed by the...

PT-2022-27077 · Unknown · Simmeth Lieferantenmanager

Name of the Vulnerable Software and Affected Versions: Simmeth Lieferantenmanager versions prior to 5.6 Description: An issue in the design of the API allows a user to fetch arbitrary SQL tables, leaking all user passwords and MSSQL hashes via the "/DS/LM API/api/SelectionService/GetPaggedTab" AP...

PT-2022-27674 · Unknown · Planet Estream

Name of the Vulnerable Software and Affected Versions: Planet eStream versions prior to 6.72.10.07 Description: The issue discloses sensitive information related to the ON cookie, which can be found in the HTML source code for "Default.aspx" in certain situations, and the "WhoAmI" endpoint, which...

PT-2022-28047 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: openemr versions prior to 7.0.0.2 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input without proper validation and then displays it to other users, allowing an attacker t...

PT-2022-20963 · Dataprobe · Dataprobe Iboot Pdu

Name of the Vulnerable Software and Affected Versions: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 Description: The issue arises from certain PHP pages only validating when a valid connection is established with the database, but not verifying the validity of a user. This lack of...