Security Bulletin: IBM Match 360 is vulnerable to SnakeYaml's Constructor() class that not restrict types which can be instantiated during deserialization (CVE-2022-1471)

Summary SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to containerd security bypass and denial of service vulnerabilities( CVE-2023-25173, CVE-2023-25153)

Summary Potential containerd security bypass and denial of service vulnerabilities CVE-2023-25173, CVE-2023-25153 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-25173 DESCRIPTIO...

Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to a denial of service ( CVE-2023-27540)

Summary Potential denial of service vulnerability in IBM Watson CP4D Data Stores CVE-2023-27540 has been identified that may affect IBM Watson CP4D Data Stores Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-27540 DESCRIPTION: IBM Watson CP4D Data Stores does not...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Apache Spark

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Apache Spark. Vulnerability Details CVEID:CVE-2023-22946 DESCRIPTION: Apache Spark could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw when using...

CVE-2023-34459 OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees

OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to version 4.9.2, when the verifyMultiProof, verifyMultiProofCalldata, procesprocessMultiProof, or processMultiProofCalldat functions are in use, it is possible to construct merkle trees that...

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts version 4.7.0 through versions prior to 4.9.2. No information about this vulnerability is available at this time, so please stay tuned to CNNVD or vendo...

CVE-2023-2617

A vulnerability classified as problematic was found in OpenCV wechatqrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decodedbitstreamparser.cpp. The manipulation leads to null pointer dereference. The...

CVE-2023-32687 Insufficiently Protected ChatBot Credentials in tgstation-server

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...

CVE-2022-43377

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account. Affected Products: NetBotz 4 - 355/450/455/550/570 V4.7.0 and prior...

CVE-2023-0765 Gallery by BestWebSoft < 4.7.0 - Author+ SQL Injection

The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin https://wordpress.org/plugins/slider-bws/ must...

PT-2023-17438 · Datagear · Datagear

Name of the Vulnerable Software and Affected Versions: DataGear versions up to 4.7.0/5.1.0 Description: A problematic issue has been found in the JDBC Server Handler component of DataGear, allowing for deserialization through manipulation. This issue can be exploited remotely. The vendor was...

CVE-2023-28647 App pin of the iOS app can be bypassed in Nextcloud iOS

Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain...

WordPress Gallery Plugin < 4.7.0 is vulnerable to Cross Site Scripting (XSS)

Software Gallery Type Plugin Vulnerable versions 4.7.0 Fixed in 4.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0764 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID e9bded84374e Credits dc11 Required privilege Auth...

Nextcloud 安全漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud iOS versions prior to 4.7.0, which stems from the ability to bypass the app password of an iOS app...

WordPress Gallery Plugin <= 4.6.9 is vulnerable to Cross Site Scripting (XSS)

Software Gallery Type Plugin Vulnerable versions = 4.6.9 Fixed in 4.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID af13f829601f Credits Unknown Required privilege Administrator...

CVE-2022-37015

Symantec Endpoint Detection and Response SEDR Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected fro...

PT-2022-23759 · Symantec · Symantec Endpoint Detection/Response Appliance

Name of the Vulnerable Software and Affected Versions: Symantec Endpoint Detection and Response SEDR Appliance versions prior to 4.7.0 Description: The issue is a privilege escalation vulnerability, which allows an attacker to attempt to compromise the software application to gain elevated access...

PT-2022-5354 · Netbotz 4 · Netbotz 4

Name of the Vulnerable Software and Affected Versions: NetBotz 4 versions 4.7.0 and prior Description: The issue arises from inadequate protection of the web page structure, potentially allowing a remote attacker to execute arbitrary code. This is related to a Cross-site Scripting vulnerability,...

PT-2022-6688 · Netbotz 4 · Netbotz 4

Name of the Vulnerable Software and Affected Versions: NetBotz 4 versions 4.7.0 and prior Description: A vulnerability exists that could cause the user to be tricked into performing unintended actions when external address frames are not properly restricted. This issue is related to improper...

CVE-2022-37015

Symantec Endpoint Detection and Response SEDR Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected fro...