PT-2023-28754 · 70Mai · 70Mai A500S

Name of the Vulnerable Software and Affected Versions: 70mai a500s version 1.2.119 Description: The issue is related to incorrect access control, allowing attackers to directly access and delete video files of the driving recorder through ftp and other protocols. Recommendations: For version...

PT-2023-29170 · Unknown · Matias'S Shockingly Simple Favicon

Name of the Vulnerable Software and Affected Versions: Matias's Shockingly Simple Favicon plugin versions = 1.8.2 Description: A Cross-Site Request Forgery CSRF issue affects the plugin, allowing unauthorized actions to be performed on behalf of the user. Recommendations: For versions = 1.8.2,...

Oracle VirtualBox: Multiple Vulnerabilities

Background VirtualBox is a powerful virtualization product from Oracle. Description Multiple vulnerabilities have been discovered in Oracle VirtualBox, the worst of which may lead to VirtualBox compromise by an attacker with network access. Please review the CVE identifiers referenced below for...

PT-2023-29526 · Atos · Atos Unify Openscape 4000 Assistant +1

Name of the Vulnerable Software and Affected Versions: Atos Unify OpenScape 4000 Assistant versions V10 R0 through V10 R1 before V10 R1.42.1 Atos Unify OpenScape 4000 Manager versions V10 R0 through V10 R1 before V10 R1.42.1 Description: The issue allows Authenticated Command Injection via AShbr...

PT-2023-24384 · Ocomon · Ocomon

Name of the Vulnerable Software and Affected Versions: OcoMon versions prior to 4.0.1 Description: A local file inclusion issue via the lang parameter allows attackers to execute arbitrary code by supplying a crafted PHP file. This can be achieved by exploiting the vulnerability in the lang...

GHSA-WQCR-XM43-HPQR Vulnerable version of libwebp and can be exploited with a malicious source image

Impact This vulnerability affects deployments of FreeImage that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you, but you should remove FreeImage from your project, as it is not maintained and presents a massive...

PT-2023-28023 · WordPress · Venugopal Remove/Hide Author

Name of the Vulnerable Software and Affected Versions: Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin versions = 2.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web...

PT-2023-29293 · Unknown · Zenario Cms

Name of the Vulnerable Software and Affected Versions: Zenario CMS version 9.4.59197 Description: A Cross-Site Scripting XSS issue allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias. This enables the attacker to perform unauthorized actions on the...

GHSA-PFFG-92CG-XF5C gnark-crypto's exponentiation in the pairing target group GT using GLV can give incorrect results

Impact When the exponent is bigger than r, the group order of the pairing target group GT, the exponentiation à la GLV ExpGLV can sometimes give incorrect results compared to normal exponentiation Exp. The issue impacts all users using ExpGLV for exponentiations in GT. This does not impact Exp an...

PT-2023-5765 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G version A1V1.0.2B05 Description: The issue is related to a buffer overflow in the SetWLanRadioSettings function via the TXPower parameter. This allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2023-27700 · Unknown · Prixan Prixanconnect

Name of the Vulnerable Software and Affected Versions: Prixan prixanconnect versions up to v1.62 Description: The issue is related to a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::importProducts. This vulnerability allows for the injection of malicious SQL...

CVE-2023-43809 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled

Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, remote attacker to bypass public key authentication when keyboard-interactive SSH authentication is active, through the allow-keyless...

CVE-2023-43809 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled

Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, remote attacker to bypass public key authentication when keyboard-interactive SSH authentication is active, through the allow-keyless...

GHSA-498W-5J49-VQJG gnark unsoundness in variable comparison / non-unique binary decomposition

Impact For some in-circuit values, it is possible to construct two valid decomposition to bits. In addition to the canonical decomposition of a, for small values there exists a second decomposition for a+r where r is the modulus the values are being reduced by. The second decomposition was possib...

gnark unsoundness in variable comparison / non-unique binary decomposition

Impact For some in-circuit values, it is possible to construct two valid decomposition to bits. In addition to the canonical decomposition of a, for small values there exists a second decomposition for a+r where r is the modulus the values are being reduced by. The second decomposition was possib...

CVE-2023-5370

On CPU 0 the check for the SMCCC workaround is called before SMCCC support has been initialized. This resulted in no speculative execution workarounds being installed on CPU 0...

CVE-2023-5370

On CPU 0 the check for the SMCCC workaround is called before SMCCC support has been initialized. This resulted in no speculative execution workarounds being installed on CPU 0...

CVE-2023-5370 arm64 boot CPUs may lack speculative execution protections

On CPU 0 the check for the SMCCC workaround is called before SMCCC support has been initialized. This resulted in no speculative execution workarounds being installed on CPU 0...

PT-2023-29225 · Unknown · Sanitize-Html

Name of the Vulnerable Software and Affected Versions: HtmlSanitizer versions prior to 8.0.723 HtmlSanitizer version 8.1.722-beta and earlier Description: The issue occurs in configurations where foreign content is allowed, specifically when svg or math are in the list of allowed elements. This...

PT-2023-29324 · Unknown · Easy Chat Server

Name of the Vulnerable Software and Affected Versions: Easy Chat Server versions 3.1 and earlier Description: The issue arises from insufficient encryption of user-controlled inputs, leading to a Cross-Site Scripting XSS vulnerability. This vulnerability is stored via the "/registresult.htm" API...