OPENSUSE-SU-2023:0368-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 119.0.6045.123 boo1216978 CVE-2023-5996: Use after free in WebAudio Chromium 119.0.6045.105 boo1216783 CVE-2023-5480: Inappropriate implementation in Payments CVE-2023-5482: Insufficient data validation in USB CVE-2023-5849: Integer...

PT-2023-7209

Name of the Vulnerable Software and Affected Versions Symfony versions 2.0.0 through 4.4.50 Symfony versions 5.0.0 through 5.4.30 Symfony versions 6.0.0 through 6.3.7 Description The issue exists due to some Twig filters in CodeExtension using is safe=html but not ensuring their input is safe. Th...

CVE-2023-5079

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

CVE-2023-5079

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

Input validation

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

CVE-2023-5079

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

CVE-2023-5079

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

PT-2023-31651 · Lenovo · Lenovo Lecloud App

Name of the Vulnerable Software and Affected Versions: Lenovo LeCloud App affected versions not specified Description: The issue is related to improper input validation in the Lenovo LeCloud App, allowing attackers to access arbitrary components and perform arbitrary file downloads. This could...

perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS

A flaw was found in Perl's CPAN, which doesn't check TLS certificates when downloading content. This happens due to verifySSL missing when suing the HTTP::Tiny library during the connection. This may allow an attacker to inject into the network path and perform a Man-In-The-Middle attack, causing...

Fedora 39 : chromium (2023-0b39dc9302)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-0b39dc9302 advisory. update to 118.0.5993.117. Security release for CVE-2023-5472 ---- Update to 118.0.5993.88 ---- Update to 118.0.5993.70. Include following security...

Moderate: perl-CPAN security update

The CPAN module is a tool to query, download and build perl modules from CPAN sites. Security Fixes: perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS CVE-2023-31484 For more details about the security issues, including the impact, a CVSS score,...

The vulnerability of the /emap/devicePoint_addImgIco?hasSubsystem=true file is related to the unlimited loading of dangerous files. This vulnerability allows a violator to execute arbitrary code.

Vulnerability of the file /emap/devicePointaddImgIco?hasSubsystem=true. Dahua Smart Park Management’s smart technology for parking management involves unlimited downloading of dangerous type files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Ibexa ezplatform-kernel download route allows filename change

Impact The route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and...

GHSA-GV2C-5G79-H73C Ibexa ezplatform-kernel download route allows filename change

Impact The route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and...

Download route allows filename change in eZpublish kernel

Impact The route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and...

GHSA-946C-F9W6-2C25 Download route allows filename change in eZpublish kernel

Impact The route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and...

Microsoft Edge (Chromium) < 118.0.2088.88 / 119.0.2151.44 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 118.0.2088.88 / 119.0.2151.44. It is, therefore, affected by multiple vulnerabilities as referenced in the November 2, 2023 advisory. - Microsoft Edge Chromium-based Remote Code Execution Vulnerability CVE-2023-36022,...

The vulnerability of the LinuxASMCallGraph software development tool, related to the unlimited loading of dangerous files, allows a hacker to execute arbitrary code.

The vulnerability of the LinuxASMCallGraph graph-building software lies in the ability to download unlimited quantities of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by downloading a specially created ZIP file remotely...

PT-2023-33018 · Ibexa · Ibexa Dxp +1

Name of the Vulnerable Software and Affected Versions: Ibexa DXP and eZ Platform versions affected versions not specified Description: The issue allows specifying the name of the downloaded file in the route used for file downloads, which could lead to misunderstandings, confusion, and possibly...

PT-2023-33021 · Ez Systems +1 · Ezpublish-Kernel +4

Name of the Vulnerable Software and Affected Versions: Ibexa DXP and eZ Platform affected versions not specified ezsystems/ezplatform-kernel affected versions not specified ezsystems/ezpublish-kernel affected versions not specified ibexa/core affected versions not specified Description: The issue...