CVE-2023-4136

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27...

CVE-2023-4136

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27...

CVE-2023-4136 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27...

CVE-2023-4136

CrafterCMS Engine is vulnerable to reflected XSS (CVE-2023-4136). The nuclei template shows exploitation via the transformerName parameter in the /api/1/site/url/transform endpoint, enabling an unauthenticated attacker to inject arbitrary JavaScript in the user context and potentially steal crede...

PT-2023-12751 · Unknown · Tetra Ta61

Name of the Vulnerable Software and Affected Versions: TETRA TA61 affected versions not specified Description: The TETRA TA61 identity encryption function uses a 64-bit value derived from the SCK Class 2 networks or CCK Class 3 networks. This structure allows for efficient recovery of the 64-bit...

SUSE SLED12: install-initrd-SLES / tftpboot-installation-SLED-12-SP5-x86_64 / etc (SUSE-SU-2023:2819-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2819-1 advisory. - rebuild the package with the new secure boot key bsc1209188. Tenable has extracted the preceding description block...

Microsoft Outlook 安全漏洞

Microsoft Outlook is a suite of e-mail applications from Microsoft Corporation USA. A security vulnerability exists in Microsoft Office Outlook. An attacker could exploit this vulnerability to bypass certain features. The following products and editions are affected: Microsoft 365 Apps for...

Microsoft Win32k 安全漏洞

Microsoft Win32k is a system file for Windows multi-user management from Microsoft USA. A security vulnerability exists in Microsoft Win32k. The following products and versions are affected:Windows 10 Version 1809 for 32-bit Systems,Windows 10 Version 1809 for x64-based Systems,Windows 10 Version...

Microsoft 365 MSO 2305 Build 16.0.16501.20074 Remote Code Execution

Title: Microsoft 365 MSO Version 2305 Build 16.0.16501.20074 64-bit Remote Code Execution Vulnerability Author: nu11secur1ty Date: 04.17.2023 Vendor: https://www.microsoft.com/ Software: https://www.microsoft.com/en-us/microsoft-365/ Reference:...

openSUSE 15: libopenssl-3-devel / libopenssl-3-devel-32bit / libopenssl3 / etc (SUSE-SU-2023:2470-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2470-1 advisory. - Update to version 3.0.8 bsc1207541. - CVE-2022-40735: Fixed remote trigger of expensive server-side DHE modular-exponentiation with long exponents ...

June 6, 2023, update for Visio 2016 (KB5002349)

None None...

Security Bulletin: IBM QRadar WinCollect Agent is vulnerable to execution with unnecessary privileges (CVE-2023-26277)

Summary IBM QRadar WinCollect Agent is vulnerable to execution with unnecessary privileges. IBM has addressed the relevant vulnerability Vulnerability Details CVEID:CVE-2023-26277 DESCRIPTION: IBM QRadar WinCollect Agent could allow a local user to execute commands on the system due to execution...

USN-6119-1: OpenSSL vulnerabilities

Matt Caswell discovered that OpenSSL incorrectly handled certain ASN.1 object identifiers. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, resulting in a denial of service. CVE-2023-2650 Anton Romanov discovered that OpenSSL incorrectly handled AES-XTS ciphe...

Design/Logic Flaw

Copyfromuser on 64-bit versions of the Linux kernel does not implement the uaccessbeginnospec allowing a user to bypass the "accessok" check and pass a kernel pointer to copyfromuser. This would allow an attacker to leak information. We recommend upgrading beyond...

CVE-2023-0459 Copy_from_user Spectre-V1 Gadget in Linux Kernel

Copyfromuser on 64-bit versions of the Linux kernel does not implement the uaccessbeginnospec allowing a user to bypass the "accessok" check and pass a kernel pointer to copyfromuser. This would allow an attacker to leak information. We recommend upgrading beyond...

kernel: bpf, arm64: Fixed a BTI error on returning to patched function

A control-flow integrity flaw was found in the Linux kernel on the arm64 architecture within the extended Berkeley Packet Filter trampoline return path. Returning to a patched function with an instruction sequence that fails the branch-target security check can trigger an exception and panic. A...

May 2, 2023, update for PowerPoint 2013 (KB4504725)

May 2, 2023, update for PowerPoint 2013 KB4504725 This article describes update 4504725 for Microsoft PowerPoint 2013 that was released on May 2, 2023. This update also applies to Office Home and Student 2013 RT.Be aware that the update in the Microsoft Download Center applies to the Microsoft...

K000133752: OpenSSL vulnerability CVE-2023-1255

Security Advisory Description Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash ...

SUSE CVE-2023-1255

Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The...