CVE-2023-45147

Discourse (CVE-2023-45147) allows any user to add arbitrary keys to a topic's custom fields. Impact depends on installed plugins; with default plugins, impact is low/none. Patched in the latest Discourse: upgrade to version 3.1.1 (stable) or 3.2.0.beta2 (beta). If upgrade isn’t possible, disable ...

CVE-2023-45147 Arbitrary keys can be added to a topic's custom fields by any user in Discourse

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation...

Code injection

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack...

CLSA-2023-1697465582 curl: Fix of CVE-2023-38546

CVE-2023-38546: cookie: remove unnecessary struct fields...

CLSA-2023-1697465164 curl: Fix of CVE-2023-38546

CVE-2023-38546: cookie: remove unnecessary struct fields...

curl: Fix of CVE-2023-38546

CVE-2023-38546: cookie: remove unnecessary struct fields - Rebuild expired test certificates...

CLSA-2023-1697464688 curl: Fix of CVE-2023-38546

CVE-2023-38546: cookie: remove unnecessary struct fields - Rebuild expired test certificates...

CLSA-2023-1697464394 curl: Fix of CVE-2023-38546

CVE-2023-38546: cookie: remove unnecessary struct fields - Rebuild expired test certificates...

CLSA-2023-1697463947 curl: Fix of CVE-2023-38546

CVE-2023-38546: cookie: remove unnecessary struct fields - Rebuild expired test certificates...

CLSA-2023-1697463486 Fix CVE(s): CVE-2023-38546

SECURITY UPDATE: сookie injection with none file - debian/patches/CVE-2023-38546.patch: remove unnecessary struct fields in lib/cookie.c - CVE-2023-38546...

PT-2023-29438 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.1 Discourse versions prior to 3.2.0.beta2 Description: Discourse is an open source community platform. In affected versions, any user can create a topic and add arbitrary custom fields to a topic. The severity ...

Discourse Information Disclosure Vulnerability

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. An information disclosure vulnerability exists in Discourse that originates from allowing any user to create a topic and add arbitrary custom fields to the topic...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the MiniZip function in zlib, by providing a long filename, comment, or extra field. Remediation Upgrade zlib to version 1.3.1 or higher. References - GitHub Commit - GitHub PR - Vulnerable Code...

AZL-43609 CVE-2023-45853 affecting package blosc 1.21.4-2

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

PrestaShop Cross-Site Scripting Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A security vulnerability exists in PrestaShop Opart opartmultihtmlblock version 2.0.1...

Cross-site Scripting (XSS)

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Cross-site Scripting XSS through vulnerable form fields. An attacker can execute malicious scripts in the victim's browser by injecting malicious...

Cross-site Scripting (XSS)

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS through vulnerable form fields. An attacker can execute malicious scripts in the victim's browser by injecting malicious JavaScript into these...

CVE-2023-38219 Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious...

PT-2023-22556 · Opart · Opart Multihtmlblock*

Name of the Vulnerable Software and Affected Versions: Opart opartmultihtmlblock versions prior to 2.0.12 Opart multihtmlblock version 1.0.0 Description: Multiple Stored Cross Site Scripting XSS vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the body...

mariadb: server crash in JOIN_CACHE::free or in copy_fields

MariaDB v10.7 was discovered to contain an use-after-poison in in interceptormemset at /libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc...