PT-2023-10586 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer...

PT-2023-10549 · Unknown +1 · Insteon Hub +1

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer...

PT-2023-10606 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub. Specially crafted commands sent through the PubNub service can cause a...

PT-2023-1278 · Cisco · Cisco Webex Room Phone +1

Name of the Vulnerable Software and Affected Versions: Cisco Webex Room Phone affected versions not specified Cisco Webex Share affected versions not specified Description: A vulnerability in the Link Layer Discovery Protocol LLDP feature could allow an unauthenticated, adjacent attacker to cause...

PT-2023-10594 · Unknown · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub. Specially crafted commands sent through the PubNub service can cause a...

Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted

If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view the discussion is able to create a new reply via the REST API, no matter the reply permission or lock status. This includes users that don't have a validated email. Guests cannot...

GHSA-HPH3-HV3C-7725 Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted

If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view the discussion is able to create a new reply via the REST API, no matter the reply permission or lock status. This includes users that don't have a validated email. Guests cannot...

GHSA-22M9-M3WW-53H3 Flarum post mentions can be used to read any post on the forum without access control

Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special @""p syntax. The following behavior never changes no matter if the actor should be able to read the mentioned post or not: A URL to the mentioned post is inserted into...

PocketMine-MP vulnerable to denial-of-service by sending large modal form responses

Impact Due to a workaround for an old client bug which has since been fixed, very large JSON payloads in ModalFormResponsePacket were able to cause the server to spend a significant amount of time processing the packet. Large numbers of these packets were able to hog CPU time so as to prevent the...

PT-2023-1111 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions 18.0 and earlier Adobe InDesign versions 17.4 and earlier Description: The issue is related to insufficient input validation in Adobe InDesign, which could allow an attacker to execute arbitrary code. Exploitation of...

PT-2023-18538 · Flarum · Flarum

Name of the Vulnerable Software and Affected Versions: Flarum versions prior to 1.6.3 Description: The issue concerns the mentions feature provided by the flarum/mentions extension, which allows users to mention any post ID on the forum using a special syntax. This feature leaks the discussion ID...

PT-2023-14625 · Archibus · Archibus Web Central

Name of the Vulnerable Software and Affected Versions: Archibus Web Central version 2022.03.01.107 Description: An issue was discovered in the application where a service exposed allows a basic user to access the profile information of all connected users. Recommendations: For Archibus Web Centra...

PT-2023-18539 · Flarum · Flarum

Name of the Vulnerable Software and Affected Versions: Flarum versions prior to 1.6.3 Description: The issue allows an actor to read restricted or private content and bypass access checks by using the notifications feature. The notification-sending component does not verify if the subject of the...

mercurius has Uncaught Exception when using subscriptions

Impact Any users of Mercurius until version v11.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. Patches This was patched in https://github.com/mercurius-js/mercurius/pull/940. The patch was released as v11.5.0 and v8.13.2. Workarounds...

CVE-2023-22477

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...

Code injection

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...

CVE-2023-22477 Mercurius is vulnerable to denial of service (DoS) when using subscriptions

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...

PT-2023-12829 · Wifey · Wifey

Name of the Vulnerable Software and Affected Versions: wifey affected versions not specified Description: The issue is related to Command Injection via the connect function due to improper input sanitization. This allows for potential exploitation. No information is provided about the estimated...

PT-2023-12412 · Webpa · Webpa

Name of the Vulnerable Software and Affected Versions: WebPA versions up to 3.1.1 Description: A critical issue affects some unknown processing, leading to sql injection. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world...

PT-2023-10136 · Unknown · Emmflo Yuko-Bot

Name of the Vulnerable Software and Affected Versions: emmflo yuko-bot affected versions not specified Description: A vulnerability was found in emmflo yuko-bot, declared as problematic. The manipulation of the title argument leads to denial of service. The attack can be initiated remotely...