Three Ways To Supercharge Your Software Supply Chain Security

Section four of the "Executive Order on Improving the Nation's Cybersecurity" introduced a lot of people in tech to the concept of a "Software Supply Chain" and securing it. If you make software and ever hope to sell it to one or more federal agencies, you have to pay attention to this. Even if y...

GHSA-X5MR-P6V4-WP93 Field injection in the KirbyData text storage handler

TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file e.g. via a contact or comment form. Your Kirby sites are not affected if they don't allow write access for...

Information disclosure

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file e.g. via a...

CVE-2023-38488 Kirby vulnerable to field injection in the KirbyData text storage handler

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file e.g. via a...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the comliferaylayoutadminwebportletGroupPagesPortletbackURL parameter in the SEO configuration process. An attacker can execute arbitrary code by tricking a user into performing actions through crafte...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the comliferaylayoutadminwebportletGroupPagesPortletbackURL parameter in the SEO configuration of the Layout module. An attacker can cause users to be redirected to arbitrary external URLs by tricking them into clickin...

CVE-2023-2253 vulnerabilities

Vulnerabilities for packages: kpt, argocd-image-updater, kubernetes-dashboard, argocd-image-updater-fips, aactl, bom...

CVE-2023-2253 vulnerabilities

Vulnerabilities for packages: bom, argocd-image-updater, aactl, kubernetes-dashboard, kpt...

GHSA-HQXW-F8MX-CPMW vulnerabilities

Vulnerabilities for packages: bom, argocd-image-updater, aactl, kubernetes-dashboard, kpt...

GHSA-HQXW-F8MX-CPMW vulnerabilities

Vulnerabilities for packages: kpt, argocd-image-updater, kubernetes-dashboard, argocd-image-updater-fips, aactl, bom...

cc.vihackerframework:vihacker-auth-starter (=1.0.8.R), cc.vihackerframework:vihacker-common-starter (=1.0.8.R) +786 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=3.0.0 <=3.0.5)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =3.0.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.4.0 and more Source cves: CVE-2023-20873 Source advisory: OSV:GHSA-G5H3-W546-PJ7F...

CVE-2023-28841 vulnerabilities

Vulnerabilities for packages: bom, ctop, melange, up, apko, ko, helm...

CVE-2023-28840 vulnerabilities

Vulnerabilities for packages: bom, ctop, melange, up, apko, ko, helm...

CVE-2023-28841 vulnerabilities

Vulnerabilities for packages: ctop, ko, up, helm, melange, bom, apko...

GHSA-232P-VWFF-86MP vulnerabilities

Vulnerabilities for packages: ctop, ko, up, helm, melange, bom, apko...

GHSA-33PG-M6JH-5237 vulnerabilities

Vulnerabilities for packages: ctop, ko, up, helm, melange, bom, apko...

GHSA-33PG-M6JH-5237 vulnerabilities

Vulnerabilities for packages: bom, ctop, melange, up, apko, ko, helm...

GHSA-6WRF-MXFJ-PF5P vulnerabilities

Vulnerabilities for packages: bom, ctop, melange, up, apko, ko, helm...

GHSA-6WRF-MXFJ-PF5P vulnerabilities

Vulnerabilities for packages: ctop, ko, up, helm, melange, bom, apko...

SUSE CVE-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to...