CVE-2023-26750

Summary of CVE-2023-26750 : Yii 2 Framework prior to 2.0.47 contains a SQL injection vulnerability in the runAction function that can allow a remote attacker to execute arbitrary code. The issue’s impact is described as critical. Remediation available: upgrade to Yii 2.0.47 or later. Some connect...

CVE-2023-28625

modauthopenidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when OIDCStripCookies is set and a crafted cookie supplied, a NULL pointer dereference would occur,...

Security Bulletin: Operations Dashboard is vulnerable to denial of service due to multiple vulnerabilities in Go

Summary Operations Dashboard is vulnerable to denial of service due to multiple vulnerabilities in Go with details below. Vulnerability Details CVEID:CVE-2022-41724 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw when processing large TLS handshake records. By sendin...

shopclues.com Cross Site Scripting vulnerability OBB-3244718

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

hostmaster.buecherstube-berchtesgaden.de Cross Site Scripting vulnerability OBB-3244667

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-1795

creationtimestamp| type| source ---|---|--- 2023-04-02 12:23:12+00:00| seen| https://t.me/cibsecurity/61312...

freiberger-jazztage.de Cross Site Scripting vulnerability OBB-3244606

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-41717)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go caused by a flaw when handling HTTP/2 requests in the Go server. CVE-2022-41717. Golang Go is included as an operator as part of the Base OS used by our service images. Please...

AZL-25956 CVE-2023-28464 affecting package kernel for versions less than 5.15.122.1-2

hciconncleanup in net/bluetooth/hciconn.c in the Linux kernel through 6.2.9 has a use-after-free observed in hciconnhashflush because of calls to hcidevput and hciconnput. There is a double free that may lead to privilege escalation...

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Vulnerability

Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit Exploit Author: LiquidWorm Vendor: SOUND4 Ltd. Product web page: https://www.sound4.com | https://www.sound4.biz Affected version: FM/HD Radio Processing: Impact/Pulse/First Version 2: 1.1/2.15...

AZL-25812 CVE-2023-27533 affecting package rust for versions less than 1.72.0-2

A vulnerability in input validation exists in curl 8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform...

CVE-2023-25076

CVE-2023-25076 affects sniproxy: a buffer overflow in the handling of wildcard backend hosts can allow arbitrary code execution via crafted HTTP or TLS packets. Impact observed in SNIProxy 0.6.0-2 and the master branch. Exploitation details are not provided in the Initial description, but multipl...

PT-2023-19917 · Sniproxy +2 · Sniproxy +2

Name of the Vulnerable Software and Affected Versions: SNIProxy versions 0.6.0-2 through the master branch commit: 822bb80df9b7b345cc9eba55df74a07b498819ba Description: A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy. A specially crafted HTTP or TLS...

SNIProxy 安全漏洞

SNIProxy proxies incoming HTTP and TLS connections based on the hostname contained in the initial request of the TCP session. This allows HTTPS name-based virtual hosts to detach the back-end server without the need to install a private key on the proxy machine. A security vulnerability exists in...

Fedora 38 : reposurgeon (2023-76d18cf2fa)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-76d18cf2fa advisory. 4.35: 2023-03-21 - Document an importand gotcha about working with CVS. Clean up some annoyances in the build and test machinery. 4.34: 2023-01-24 - Change...

Information disclosure

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGIBEGINREQUEST record. Sensitive data may be disclos...

CVE-2023-27167

Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?searchmonth=1...

Sql injection

Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?searchmonth=1...

Moderate: Red Hat Security Advisory: Logging Subsystem for Red Hat OpenShift - 5.5.9 security update

An update is now available for Logging Subsystem for Red Hat OpenShift - 5.5.9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

Security Bulletin: IBM Event Streams is affected by a vulnerability in Golang Go (CVE-2022-41717)

Summary This security vulnerability affects the memory growth in Go before version 1.18.9 that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-41717 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw when handling HTTP/2 requests in the Go server. By...