CVE-2023-5891: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16...

CVE-2023-5896: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4...

CVE-2023-5904: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16...

CVE-2023-5901: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16...

Ubuntu 16.04 ESM / 18.04 ESM : Kerberos vulnerability (USN-6467-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6467-1 advisory. Robert Morris discovered that Kerberos did not properly handle memory access when processing RPC data through kadmind, which could lead to the freeing...

CVE-2023-5893: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in GitHub repository pkp/pkp-lib prior to 3.3.0-16...

PT-2023-32396 · Pkp-Lib · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to insufficient session expiration in the GitHub repository pkp/pkp-lib. Recommendations: For versions prior to 3.3.0-16, update to version 3.3.0-16 or later to resolve...

PT-2023-32403 · Pkp-Lib · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.4.0-4 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository pkp/pkp-lib. Recommendations: For versions prior to 3.4.0-4, update to version 3.4.0-4 or later ...

PT-2023-32402 · Pkp-Lib · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - DOM in the GitHub repository pkp/pkp-lib. This type of attack occurs when an application includes user input in its output without proper...

CVE-2023-46135

rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.innerpayloadlen should not above 64. This vulnerability has been patched in version 0.0.8...

CVE-2023-46135

The CVE-2023-46135 issue affects rs-stellar-strkey, a Rust library for Stellar Strkey encoding/decoding. A panic vulnerability occurs during processing of crafted payloads where inner_payload_len should not exceed 64; this condition is the root cause described in various advisories. The vulnerabi...

The vulnerability of the fill_kobj_path() function in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fillkobjpath function in the Linux operating system’s kernel is related to memory writing beyond the bounds of the allocated buffer in the lib/kobject.c module. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.

...

CVE-2023-46228

zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c...

CVE-2023-46228: Integer Overflow or Wraparound

zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c...

Libxpm: out of bounds read on xpm with corrupted colormap

...

CLSA-2023-1697463486 Fix CVE(s): CVE-2023-38546

SECURITY UPDATE: сookie injection with none file - debian/patches/CVE-2023-38546.patch: remove unnecessary struct fields in lib/cookie.c - CVE-2023-38546...

CLSA-2023-1697463318 Fix CVE(s): CVE-2023-38546

SECURITY UPDATE: сookie injection with none file - debian/patches/CVE-2023-38546.patch: remove unnecessary struct fields in lib/cookie.c - CVE-2023-38546...

CVE-2023-40791

extractusertosg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for trygrabpage...

CVE-2023-40791: Undefined Security Weakness

extractusertosg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for trygrabpage...