Security Bulletin: IBM MQ is vulnerable to a denial of service attack (CVE-2023-26285)

Summary IBM MQ is vulnerable to a denial of service attack caused by an error processing invalid data from a compromised client. Vulnerability Details CVEID:CVE-2023-26285 DESCRIPTION: IBM MQ could allow a remote attacker to cause a denial of service due to an error processing invalid data. CVSS...

AZL-26652 CVE-2023-2610 affecting package vim for versions less than 9.0.1562-1

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532...

CVE-2023-31433

A SQL injection issue in Logbuch in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allows authenticated attackers to execute SQL statements via the welche parameter...

CVE-2023-28473

Concrete CMS previously concrete5 versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section...

CVE-2023-28472

Concrete CMS previously concrete5 versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies...

CVE-2023-28475

Concrete CMS previously concrete5 versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized...

Design/Logic Flaw

Concrete CMS previously concrete5 in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files...

CVE-2023-28474

Concrete CMS previously concrete5 in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search...

PT-2023-21741 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions 9.0 through 9.1.3 Concrete CMS previously concrete5 versions prior to 9.2 Description: The issue is related to Stored XSS via a container name. There is no information provided about the estimated...

PT-2023-21743 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions 8.5.12 and below Concrete CMS previously concrete5 versions 9.0 through 9.1.3 Description: The issue concerns a possible Auth bypass in the jobs section of Concrete CMS. Recommendations: For versions...

CVE-2023-28477

Concrete CMS previously concrete5 versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter...

PT-2023-21742 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions 8.5.12 and below Concrete CMS previously concrete5 versions 9.0 through 9.1.3 Description: The issue is related to the ccmPoll cookies in Concrete CMS, where the Secure and HTTP only attributes are n...

PT-2023-21745 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions 8.5.12 and below Concrete CMS previously concrete5 versions 9.0 through 9.1.3 Description: The issue is related to Reflected XSS on the Reply form because the msgID was not sanitized. This allows for...

CVE-2023-28473

Concrete CMS previously concrete5 versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section...

CVE-2023-24966

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

SUSE-SU-2023:0781-2 Security update for vim

This update for vim fixes the following issues: - CVE-2023-0512: Fixed a divide By Zero bsc1207780. - CVE-2023-1175: vim: an incorrect calculation of buffer size bsc1208957. - CVE-2023-1170: Fixed a heap-based Buffer Overflow bsc1208959. - CVE-2023-1127: Fixed divide by zero in scrolldown...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2023-24966)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...

Important: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

CVE-2023-29187

Summary: CVE-2023-29187 is a DLL hijacking vulnerability in SAP SapSetup (Software Installation Program) 9.0 on Windows. The issue allows a user with basic privileges to escalate to administrator by exploiting a DLL load order/targeted DLL hijack, with the attacker needing local access and precon...

Microsoft Dynamics 跨站脚本漏洞

Microsoft Dynamics is a suite of ERP business solutions for multinational organizations from Microsoft USA. The product includes financial management, production management and business intelligence management. A security vulnerability exists in Microsoft Dynamics. The following products and...