SUSE-SU-2023:0113-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Updated to version 102.7.0 ESR bsc1207119: - CVE-2022-46871: Updated an out of date library libusrsctp which contained several vulnerabilities. - CVE-2023-23598: Fixed an arbitrary file read from GTK drag and drop on Linux. -...

SUSE-SU-2023:0111-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Updated to version 102.7.0 ESR bsc1207119: - CVE-2022-46871: Updated an out of date library libusrsctp which contained several vulnerabilities. - CVE-2023-23598: Fixed an arbitrary file read from GTK drag and drop on Linux. -...

CVE-2022-47747

CVE-2022-47747 concerns the Kraken project. The initial data and connected documents confirm an arbitrary file read vulnerability in Kraken <= 0.1.4, exploitable via the component testfs. The CVE details indicate high confidentiality impact (C/H) with no integrity or availability impact report...

CVE-2022-47747

kraken = 0.1.4 has an arbitrary file read vulnerability via the component testfs...

PT-2023-15473 · Kraken · Kraken

Name of the Vulnerable Software and Affected Versions: kraken versions 0.1.4 and earlier Description: The issue is related to an arbitrary file read vulnerability. It affects the component testfs. Recommendations: For kraken versions 0.1.4 and earlier, consider restricting access to the testfs...

CVE-2023-23597

A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. This vulnerability affects Firefo...

UBUNTU-CVE-2023-23597

A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. This vulnerability affects Firefo...

UBUNTU-CVE-2023-23598

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird...

Mozilla Firefox < 109.0

The version of Firefox installed on the remote Windows host is prior to 109.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-01 advisory. - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108. Some of these bugs...

Mozilla Firefox < 109.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 109.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-01 advisory. - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108. Some of...

Security Vulnerabilities fixed in Firefox 109 — Mozilla

A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. Due to the Firefox GTK wrapper...

Adobe InDesign < 17.4.1 / 18.0 < 18.1.0 Multiple Vulnerabilities (APSB23-07)

The version of Adobe InDesign installed on the remote Windows host is prior to 17.4.1, 18.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB23-07 advisory. - Adobe InDesign version 18.0 and earlier, 17.4 and earlier are affected by an out-of-bounds write...

Adobe InDesign < 17.4.1 / 18.0 < 18.1.0 Multiple Vulnerabilities (APSB23-07) (macOS)

The version of Adobe InDesign installed on the remote macOS host is prior to 17.4.1, 18.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB23-07 advisory. - Adobe InDesign version 18.0 and earlier, 17.4 and earlier are affected by an out-of-bounds write...

PT-2023-1605

Name of the Vulnerable Software and Affected Versions Windows versions prior to the January 2023 Patch Tuesday Description The issue is related to the implementation of the NT LAN Manager NTLM protocol in Windows operating systems, which is associated with insufficient access restrictions...

Dell EMC Unisphere for PowerMax 信息泄露漏洞

Dell EMC Unisphere for PowerMax is a suite of graphical management tools for PowerMax storage arrays from Dell USA. A security vulnerability exists in Dell EMC Unisphere for PowerMax vApp, VASA Provider vApp, and Solutions Enabler vApp version 9.2.3.x, which stems from the inclusion of incorrect...

WordPress plugin Welcart e-Commerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2023-7910 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.8.5 Description: The issue is related to the use of files and directories accessible to external parties. It does not validate user input before using it to output the content of a file,...

WordPress plugin Welcart e-Commerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2022-46492

nbnbk commit 879858451d53261d10f77d4709aee2d01c72c301 was discovered to contain an arbitrary file read vulnerability via the component /api/Index/getFileBinary...

CVE-2022-46492

CVE-2022-46492 affects nbnbk (a ThinkPHP-based CMS/e-commerce platform). The vulnerability arises from an arbitrary file read via the API endpoint /api/Index/getFileBinary, associated with commit 879858451d53261d10f77d4709aee2d01c72c301. Documents consistently describe an arbitrary file read, but...