PT-2024-23739

Name of the Vulnerable Software and Affected Versions Academy Software Foundation openexr versions 3.2.3 and earlier Description An issue in the convert function of exrmultipart.cpp allows a local attacker to cause a denial of service DoS. Recommendations For versions 3.2.3 and earlier, consider...

PYSEC-2024-234

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

PYSEC-2024-234

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

PT-2024-2426 · Unknown · Jupyter Server Proxy

Name of the Vulnerable Software and Affected Versions: Jupyter Server Proxy versions prior to 3.2.3 Jupyter Server Proxy versions prior to 4.1.1 Description: The issue is related to the lack of proper user authentication when proxying websockets in Jupyter Server Proxy. This allows unauthenticate...

BIT-KAFKA-2022-34917 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Exampl...

CVE-2024-23807

The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via...

WordPress Views for WPForms Plugin <= 3.2.2 is vulnerable to Broken Access Control

Software Views for WPForms Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.2.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0370 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2bf8391974fc Credits Francesco Carlucci Required...

Sticky Buttons < 3.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

Avo Cross-Site Scripting Vulnerability

Avo is Avo open source an open source ruby on rails admin panel creation framework. A cross-site scripting vulnerability exists in Avo version v3.2.3, which stems from a stored cross-site scripting XSS vulnerability in the keyvalue field...

WordPress WP Courses LMS Plugin <= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Courses LMS Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.2.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 884d6eecec59 Credits Unknown Required privilege...

CVE-2023-43340

Cross-site scripting XSS vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters...

CVE-2023-43341

Cross-site scripting XSS vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter...

CVE-2023-43340

Cross-site scripting XSS vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters...

PT-2023-28789 · Evolution · Evolution

Name of the Vulnerable Software and Affected Versions: evolution version 3.2.3 Description: A cross-site scripting XSS issue allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword, and cmspasswordconfim parameters. This enabl...

Evolution CMS Cross-Site Scripting Vulnerability

Evolution CMS is an open source PHP-based content management system CMS. A security vulnerability exists in Evolution CMS version v.3.2.3, which stems from a cross-site scripting XSS vulnerability in several parameters such as cmsadmin, cmsadminmail, and others...

CVE-2023-43340

Cross-site scripting XSS vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters...

CVE-2023-37536 HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3

An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request...

CVE-2022-41861 affecting package freeradius for versions less than 3.2.3-1

CVE-2022-41861 affecting package freeradius for versions less than 3.2.3-1. An upgraded version of the package is available that resolves this issue...

PT-2023-6251 · Apache +6 · Xerces-C++ +6

Name of the Vulnerable Software and Affected Versions: xerces-c++ version 3.2.3 Description: The issue is caused by an integer overflow in xerces-c++ that allows remote attackers to cause out-of-bound access via an HTTP request. This can potentially allow a remote attacker to execute arbitrary co...