Django Security Vulnerabilities

Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in Django that stems from a linear backtracking complexity issue ...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2023-35890)

Summary IBM WebSphere Application Server is used by IBM Tivoli System Automation Application Manager and could provide weaker than expected security. Required fixes for affected WebSphere Application Server has been published in the security bulletin links below. Vulnerability Details Refer to th...

Remote code execution

MiniTool Shadow Maker version 4.1 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack...

CVE-2023-38354

CVE-2023-38354 affects MiniTool Shadow Maker version 4.1. The vulnerability arises from an insecure installation process that can enable a remote code execution via a man-in-the-middle attack. The available sources (NVD/Red Hat/CVE catalogs) describe the issue and its exploitability in terms of a...

PT-2023-26381 · Minitool · Minitool Movie Maker

Name of the Vulnerable Software and Affected Versions: MiniTool Movie Maker version 4.1 Description: The issue is related to an insecure installation process in MiniTool Movie Maker, which allows attackers to achieve remote code execution through a man-in-the-middle attack. Recommendations: For...

MiniTool Movie Maker Trust Management Issue Vulnerability

MiniTool Movie Maker is a clean and simple video editing software from MiniTool. A trust management issue vulnerability exists in MiniTool Movie Maker version 4.1, which originates from allowing an attacker to achieve remote code execution via a man-in-the-middle attack...

PT-2023-16858 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 4.1 through 16.1.4 GitLab versions 16.2 through 16.2.4 GitLab versions 16.3 through 16.3.0 Description: An issue has been discovered in GitLab where it was possible to create a URL that would redirect to a different project...

GitLab 4.1 < 16.1.5 / 16.2 < 16.2.5 / 16.3 < 16.3.1 (CVE-2023-1279)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was...

CVE-2023-1465

CVE-2023-1465 affects the WordPress plugin WP EasyPay (versions before 4.1). The issue is a failure to escape generated URLs before output, causing a reflected XSS vulnerability that could be triggered against high-privilege users (e.g., admins). Public details in PatchStack and CVE sources confi...

PT-2023-17003 · WordPress · Wp Easypay

Name of the Vulnerable Software and Affected Versions: WP EasyPay WordPress plugin versions prior to 4.1 Description: The issue is related to Reflected Cross-Site Scripting, where some generated URLs are not properly escaped before being outputted back in pages. This could be used against...

AZL-27938 CVE-2023-28736 affecting package mdadm for versions less than 4.1-10

Buffer overflow in some IntelR SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access...

Moxa EDR-810 Web Server Certificate Signing Request Command Injection (CVE-2017-12125)

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the CN= parm in the /goform/netWebCSRGen uri t...

Moxa EDR-810 Web Server Cross-Site Request Forgery (CVE-2017-12126)

An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP packet can cause cross-site request forgery. An attacker can create malicious HTML to trigger this vulnerability. This plugin only works wit...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to privilege elevation due to [CVE-2023-26604]

Summary systemd is not used directly by IBM App Connect Enterprise Certified Container but is in the images as part of the base operating system. IBM App Connect Enterprise Certified Container operands are vulnerable to privilege elevation. This bulletin provides patch information to address the...

Django 3.2.x < 3.2.20, 4.1.x < 4.1.10, 4.2.x < 4.2.3 ReDoS Vulnerability - Windows

Django is prone to a regular expression denial of service ReDoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Moderate: Red Hat Security Advisory: ACS 4.1 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security RHACS. The updated image includes new features and bug fixes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detaile...

PT-2023-24974 · Xiamen Si Xin Communication Technology · Video Management System

Name of the Vulnerable Software and Affected Versions: Xiamen Si Xin Communication Technology Video management system versions 3.1 through 4.1 Description: An issue was discovered with the JSESSION IDs in the system, allowing attackers to gain escalated privileges. Recommendations: For versions 3...

CVE-2023-35131

Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14...

PT-2023-25156 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle versions 3.11 to 3.11.14 Moodle versions 4.0 to 4.0.8 Moodle versions 4.1 to 4.1.3 Moodle version 4.2 Description: The issue is related to insufficient sanitizing of user-provided data on the groups page, which poses an XSS risk. This...

CVE-2023-35131 Moodle: xss risk on groups page

Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14...