SUSE SLES15: krb5 / krb5-32bit / krb5-client / krb5-devel / krb5-plugin-kdb-ldap / etc (SUSE-SU-2024:2303-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2303-1 advisory. - CVE-2024-37370: Fixed confidential GSS krb5 wrap tokens with invalid fields were errouneously accepted bsc1227186. -...

Oracle Linux 9 : gstreamer1-plugins-good (ELSA-2024-2303)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2303 advisory. - CVE-2023-37327: integer overflow leading to heap overwrite in FLAC image tag handling Tenable has extracted the preceding description block directly from the...

CVE-2024-2303

The Easy Textillate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'textillate' shortcode in all versions up to, and including, 2.01 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Easy Textillate Plugin <= 2.01 is vulnerable to Cross Site Scripting (XSS)

Software Easy Textillate Type Plugin Vulnerable versions = 2.01 Fixed in 2.02 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2303 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e2fef30ce1b2 Credits Tien Luong Required...

CVE-2023-32446

Dell Wyse ThinOS versions prior to 2303 9.4.1141 contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local access to the device could exploit this vulnerability to read sensitive information written to the log files...

WordPress Contact Form and Calls To Action by vcita Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form and Calls To Action by vcita Type Plugin Vulnerable versions = 2.7.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2303 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID 7cc1d9903a62 Credits...

CVE-2023-2303

creationtimestamp| type| source ---|---|--- 2023-06-03 12:26:47+00:00| seen| https://t.me/cibsecurity/64960...

CVE-2023-2303

CVE-2023-2303 affects the WordPress plugin “Contact Form and Calls To Action by vcita.” The vulnerability is a Cross-Site Request Forgery caused by missing nonce validation in vcita-callback.php, allowing unauthenticated attackers to modify plugin settings and inject malicious JavaScript by convi...

CVE-2023-2303 Contact Form and Calls To Action by vcita <= 4.10.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.5. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the...

CVE-2022-2303

creationtimestamp| type| source ---|---|--- 2022-08-05 20:20:52+00:00| seen| https://t.me/cibsecurity/47628...

CVE-2022-2303

An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Passwo...

CVE-2022-2303

GitLab CE/EE CVE-2022-2303 affects all versions before 15.0.5, all 15.1 releases before 15.1.4, and all 15.2 releases before 15.2.1. Root cause: bypass of group-level 2FA by obtaining an access token via the Resource Owner Password Credentials grant. Impact: potential unauthorized access without ...

CVE-2022-2303

An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Passwo...

openSUSE: Security Advisory for php8 (SUSE-SU-2022:2303-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

RHEL 7 : microcode_ctl (RHSA-2021:2303)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2303 advisory. The microcodectl packages provide microcode updates for Intel. Security Fixes: hw: vt-d related privilege escalation CVE-2020-24489 hw:...

CVE-2021-2303

Vulnerability in the OSS Support Tools product of Oracle Support Tools component: Diagnostic Assistant. The supported version that is affected is Prior to 2.12.41. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise OSS Support Tools...

CVE-2021-2303

CVE-2021-2303 affects Oracle OSS Support Tools, component Diagnostic Assistant, with the vulnerable version prior to 2.12.41. The issue allows a high-privilege attacker, over HTTP from the network, to compromise OSS Support Tools and potentially access all data handled by the tools. ZDI also note...

SUSE: Security Advisory (SUSE-SU-2020:2303-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-2303

A cross-site request forgery CSRF vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials...

CVE-2020-2303

CVE-2020-2303 describes a CSRF vulnerability in Jenkins Active Directory Plugin (versions 2.19 and earlier) that allows an attacker to trigger connection tests against AD servers using attacker-supplied credentials. The root cause is endpoints performing connection/authentication tests without re...