Code injection

IBM Sterling Connect:Express for UNIX 1.5 browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute. IBM X-Force ID: 252055...

CVE-2023-29260

CVE-2023-29260: IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to SSRF (server-side request forgery). An authenticated attacker can trigger unauthorized requests from the affected system, potentially enabling network enumeration or other attacks. Root cause is SSRF in the server componen...

CVE-2023-29259

CVE-2023-29259 affects IBM Sterling Connect:Express for UNIX browser UI (1.5.x). The underlying issue is cookies sent without the SameSite attribute, enabling potentially cookie-based attacks. IBM bulletin lists CVSS base score 3.7 (LOW) and notes affected version 1.5.x. Remediation is to upgrade...

IBM Sterling Connect:Express for UNIX 代码问题漏洞

IBM Sterling Connect:Express for UNIX is a file transfer solution from International Business Machines IBM for the UNIX platform. A security vulnerability exists in IBM Sterling Connect Express for UNIX version 1.5 that stems from vulnerability to server-side request forgery SSRF attacks, which c...

Debian dla-3499 : libapache2-mod-auth-openidc - security update

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3499 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3499-1 [email protected]...

IBM Sterling Connect:Direct 加密问题漏洞

IBM Sterling Connect:Direct is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. IBM Sterling Connect:Direct suffers from an encryption issue vulnerability that stems from the use of weak encryption algorithms, which could be exploited by an attacker to...

PT-2023-22224 · Ibm · Ibm Sterling Connect:Express For Unix

Name of the Vulnerable Software and Affected Versions: IBM Sterling Connect:Express for UNIX version 1.5 Description: The issue is related to the use of cookies without the SameSite attribute in the browser UI, making it vulnerable to certain attacks. Recommendations: For IBM Sterling...

PT-2023-12344 · Ibm · Ibm Sterling Connect:Direct For Unix

Name of the Vulnerable Software and Affected Versions: IBM Sterling Connect:Direct for UNIX version 1.5 Description: The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations: For IBM...

IBM Sterling Connect:Express for UNIX 安全漏洞

IBM Sterling Connect:Express for UNIX is a file transfer solution from International Business Machines IBM for the UNIX platform. A security vulnerability exists in IBM Sterling Connect:Express for UNIX version 1.5, which stems from the vulnerability of the browser UI to cookies...

kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c

A use-after-free flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol L2CAP, part of the Bluetooth stack in the l2capconnect and l2capleconnectreq functions. An attacker with physical access within the range of standard Bluetooth transmission could...

kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c

A use-after-free flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol L2CAP, part of the Bluetooth stack in the l2capconnect and l2capleconnectreq functions. An attacker with physical access within the range of standard Bluetooth transmission could...

WordPress BSD Split Pay for Stripe Connect on Woo Plugin < 3.2.10 is vulnerable to Cross Site Scripting (XSS)

Software BSD Split Pay for Stripe Connect on Woo Type Plugin Vulnerable versions 3.2.10 Fixed in 3.2.10 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4cfd0c7adef7 Credits Rafie...

Debian: Security Advisory (DLA-3496-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2023-003)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.25.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-003 advisory. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to...

CVE-2023-37958

A cross-site request forgery CSRF vulnerability in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers to connect to an attacker-specified URL...

Apache Pulsar Broker Improper Authentication vulnerability

Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a...

CVE-2023-31007

Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a...

CVE-2023-31007 Apache Pulsar: Broker does not always disconnect client when authentication data expires

Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a...

Microsoft Azure Active Directory Connect 安全漏洞

Microsoft Azure Active Directory Connect ADC is a service from the U.S.-based Microsoft that provides identity and access management in the cloud. A security vulnerability exists in Microsoft Azure Active Directory Connect. An attacker exploiting the vulnerability could bypass certain features...

Microsoft Azure Active Directory Connect 安全漏洞

Microsoft Azure Active Directory Connect ADC is a service from the U.S.-based Microsoft that provides identity and access management in the cloud. A security vulnerability exists in Microsoft Azure Active Directory Connect. An attacker exploiting the vulnerability could bypass certain features. T...