Amazon Linux 2 : qemu (ALAS-2023-2060)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2060 advisory. An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits tx descriptors in...

Amazon Linux 2 : kernel (ALAS-2023-2050)

The version of kernel installed on the remote host is prior to 4.14.314-238.539. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2050 advisory. In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to...

Amazon Linux 2 : thunderbird (ALAS-2023-2051)

The version of thunderbird installed on the remote host is prior to 102.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2051 advisory. In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to...

Amazon Linux 2 : glib2 (ALAS-2023-2058)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2058 advisory. A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged...

Amazon Linux 2 : tar (ALAS-2023-2064)

The version of tar installed on the remote host is prior to 1.26-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2064 advisory. paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed...

Amazon Linux 2 : squid (ALAS-2023-2066)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2066 advisory. Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Perl vulnerability (USN-6112-2)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6112-2 advisory. USN-6112-1 fixed vulnerabilities in Perl. This update provides the corresponding updates for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 22.10,...

Amazon Linux 2 : squid (ALAS-2023-2063)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2063 advisory. An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the...

Amazon Linux 2 : jettison (ALAS-2023-2053)

The version of jettison installed on the remote host is prior to 1.3.3-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2053 advisory. An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in o...

Amazon Linux 2 : golang (ALAS-2023-2052)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2052 advisory. html/template: improper sanitization of CSS values Angle brackets were not considered dangerous characters when inserted into CSS...

Amazon Linux 2 : fribidi (ALAS-2023-2054)

The version of fribidi installed on the remote host is prior to 1.0.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2054 advisory. A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidicaprtltounicode function of the...

Amazon Linux 2 : libplist (ALAS-2023-2067)

The version of libplist installed on the remote host is prior to 1.12-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2067 advisory. A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plistfromxml of the fil...

Amazon Linux 2 : mariadb (ALAS-2023-2057)

The version of mariadb installed on the remote host is prior to 5.5.68-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2057 advisory. getsortbytable in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY. CVE-2021-46657...

HTML Injection / Possible XSS

Description In pimcore I was able to identify a Unauthenticated HTML Injection / XSS Possible. Conditions: 2 factor authentication must not set before Vulnerable Endpoint: http://localhost/admin/login/2fa-setup Vulnerable Param: error= How it works, So basically any admin, who has not setup 2...

lexxusnorton.cz Cross Site Scripting vulnerability OBB-3377678

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

jhinmobiliaria.es Cross Site Scripting vulnerability OBB-3377648

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

mdw.ac.at Cross Site Scripting vulnerability OBB-3377620

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-31490 affecting package frr for versions less than 8.5.1-2

CVE-2023-31490 affecting package frr for versions less than 8.5.1-2. A patched version of the package is available...

v-storage.bnarts.jp Cross Site Scripting vulnerability OBB-3376891

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

acotex-quincaillerie.fr Cross Site Scripting vulnerability OBB-3376571

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...