PT-2023-31669 · Unknown · Basix Nex-Forms

Name of the Vulnerable Software and Affected Versions: Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more versions through 8.5.5 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This...

PT-2023-31654 · Unknown · Wipeout Media Css & Javascript Toolbox

Name of the Vulnerable Software and Affected Versions: Wipeout Media CSS & JavaScript Toolbox versions n/a through 11.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

PT-2023-30588 · Clever · Delete Duplicate Posts

Name of the Vulnerable Software and Affected Versions: Delete Duplicate Posts versions n/a through 4.8.9 Description: The issue is related to a Missing Authorization vulnerability in Clever plugins, specifically in the Delete Duplicate Posts plugin. This vulnerability allows accessing functionali...

PT-2023-24483 · Veribase · Veribase

Name of the Vulnerable Software and Affected Versions: Veribase versions through 20231123 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. The vendor was contacted...

PT-2023-30439 · Headscale · Headscale

Name of the Vulnerable Software and Affected Versions: Headscale versions through 0.22.3 Description: The issue allows Headscale to write bearer tokens to info-level logs. Recommendations: For versions through 0.22.3, consider restricting log access to minimize the risk of exploitation. At the...

PT-2023-4530 · Apache · Apache Traffic Server

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions through 9.2.1 Description: The issue is caused by improper input validation in the Range Header Handler component of the Apache Traffic Server. This can be exploited by a remote attacker to cause a denial of...

PT-2023-24364 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: Craft CMS versions through 4.4.9 Description: The issue is related to HTML Injection. Recommendations: For versions through 4.4.9, update to a version later than 4.4.9 to resolve the issue...

PT-2023-3487 · Zoho · Zoho Manageengine Adselfservice Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions through 6113 Description: The issue is related to an authentication bypass in a critical function, which can be exploited to steal the domain controller session token for identity spoofing. This...

PT-2023-24963 · Unknown · Kioware For Windows

Name of the Vulnerable Software and Affected Versions: KioWare for Windows versions through 8.33 Description: The issue is related to an incomplete blacklist filter for blocked dialog boxes on Windows 10. Attackers can exploit this by opening a file dialog box via the window.print function, which...

PT-2023-14632 · Unknown · Livebox Collaboration Vdesk

Name of the Vulnerable Software and Affected Versions: LIVEBOX Collaboration vDesk versions through v018 Description: An issue exists due to Broken Access Control under the "/api/v1/vdesk DOMAIN/export" endpoint. A malicious user, authenticated to the product without any specific privilege, can u...

PT-2023-21664 · Zoho · Zoho Manageengine Applications Manager

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Applications Manager versions through 16340 Description: A stored Cross site scripting XSS issue allows an unauthenticated user to inject malicious javascript on the incorrect login details page. This can be exploited by...

PT-2022-22782 · WordPress · Webmaster Tools Verification

Name of the Vulnerable Software and Affected Versions: Webmaster Tools Verification WordPress plugin versions through 1.2 Description: The issue concerns a lack of authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins. Recommendations: F...

GHSA-X5CW-843F-R366 x-data-spreadsheet through 1.1.9 vulnerable to Cross-site Scripting

All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting XSS due to missing sanitization of values inserted into the cells...

PT-2022-22816 · H3C · H3C Ssl Vpn

Name of the Vulnerable Software and Affected Versions: H3C SSL VPN versions through 2022-07-10 Description: The issue allows for XSS through the svpnlang cookie in the wnm/login/login.json API endpoint. Recommendations: For versions through 2022-07-10, as a temporary workaround, consider...

PT-2022-5116 · Unknown · Dotcms Core

Name of the Vulnerable Software and Affected Versions: dotCMS Core versions through 22.06 Description: The issue is related to a Reflected Cross-site scripting XSS problem in the admin portal of dotCMS Core. This occurs when the configuration has XSS PROTECTION ENABLED set to false. The...

PT-2022-20191 · Gradle · Gradle Enterprise

Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions through 2022.2.2 Description: The issue is related to Incorrect Access Control, which can lead to code execution. Recommendations: For Gradle Enterprise versions through 2022.2.2, update to a version later than...

PT-2022-16479 · Fromsoftware · Dark Souls Iii

Name of the Vulnerable Software and Affected Versions: Dark Souls III versions through 2022-03-19 Description: The matchmaking servers allow remote attackers to send arbitrary push requests to clients via a "RequestSendMessageToPlayers" request. This issue is restricted on the client side and can...

PT-2022-17205 · Cerebrate · Cerebrate

Name of the Vulnerable Software and Affected Versions: Cerebrate versions through 1.4 Description: An issue was discovered that allows reflected XSS in form descriptions via a user-controlled description. This occurs in the genericForm component. Recommendations: For versions through 1.4, as a...

PT-2022-17206 · Cerebrate · Cerebrate

Name of the Vulnerable Software and Affected Versions: Cerebrate versions through 1.4 Description: An issue was discovered that allowed an unprivileged user to edit and modify sharing groups due to an incorrect sharing group ACL. Recommendations: For versions through 1.4, as a temporary workaroun...

PT-2021-4019 · Putty +1 · Putty +1

Name of the Vulnerable Software and Affected Versions: PuTTY versions through 0.75 Description: The issue is related to insufficient authentication data verification in the implementation of the SSH protocol in PuTTY. This can allow a remote attacker to gain unauthorized access to protected...