SUSE-SU-2023:0058-1 Security update for systemd

This update for systemd fixes the following issues: Fixing the following issues: - units: restore RemainAfterExit=yes in systemd-vconsole-setup.service - vconsole-setup: don't concat strv if we don't need to i.e. not in debug log mode - vconsole-setup: add more log messages - units: restore Befor...

Insufficient Entropy In Randomly-Generated Alphanumeric Strings

github.com/masterminds/goutils has insufficient entropy In randomly-generated alphanumeric strings. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9 which significantly reduces the amount of entropy in short strings...

PT-2023-10143 · Unknown · Mapoor Voteapp

Name of the Vulnerable Software and Affected Versions: mapoor voteapp affected versions not specified Description: A critical issue has been found, affecting the function create poll/do poll/show poll/show refresh of the file app.py. This issue leads to sql injection. Recommendations: Apply a pat...

MEGA International HOPEX 跨站脚本漏洞

MEGA International HOPEX is a single software platform from MEGA International, France. combining integrated software solutions including privacy and data management, business process analysis and risk management. A security vulnerability exists in MEGA International HOPEX version 15.2.0.6110,...

Calling execute() and executeBatch() functions in SmartAccount.sol from the EntryPoint will fail

Lines of code Vulnerability details Impact The function requireFromEntryPointOrOwner is being called within the execute and executeBatch functions to check if the msg.sender is either the owner or the EntryPoint contract, but these functions have onlyOwner modifier, which will only allow the owne...

Denial Of Service (DoS)

newsboat is vulnerable to denial of service DoS attacks. Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected functions are...

DEBIAN-CVE-2022-46489

GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the gfisomboxparseex function at boxfuncs.c...

Security Restrictions Bypass

sqlite is vulnerable to security restrictions bypass. When relying on --safe for execution of an untrusted CLI script, it does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE...

coebot-www 跨站脚本漏洞

coebot-www is a web interface for CoeBot by Hayden Schiff, an individual developer. A cross-site scripting vulnerability exists in coebot-wwww, which stems from the functions displayChannelCommands/displayChannelQuotes/displayChannelAutoreplies/showChannelHighlights/showChannelBoi in the...

PT-2023-10327 · Unknown · Coebot-Www

Name of the Vulnerable Software and Affected Versions: coebot-www affected versions not specified Description: A problematic issue was found, affecting the function displayChannelCommands/displayChannelQuotes/displayChannelAutoreplies/showChannelHighlights/showChannelBoir of the file js/channel.j...

CVE-2022-43438

The Administrator function of EasyTest has an Incorrect Authorization vulnerability. A remote attacker authenticated as a general user can exploit this vulnerability to bypass the intended access restrictions, to make API functions calls, manipulate system and terminate service...

Authorization

The Administrator function of EasyTest has an Incorrect Authorization vulnerability. A remote attacker authenticated as a general user can exploit this vulnerability to bypass the intended access restrictions, to make API functions calls, manipulate system and terminate service...

WordPress plugin User Post Gallery 命令注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A command injection vulnerability...

PT-2023-14202 · Easytest · Easytest

Name of the Vulnerable Software and Affected Versions: EasyTest affected versions not specified Description: The Administrator function of EasyTest has an Incorrect Authorization issue. A remote attacker authenticated as a general user can exploit this to bypass intended access restrictions, make...

GoUtils's randomly-generated alphanumeric strings contain significantly less entropy than expected

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by...

HotCRP Conference Review Software 跨站脚本漏洞

HotCRP Conference Review Software is a software from Eddie Kohler's personal developer. It is used to manage the review process, especially for academic conferences. HotCRP Conference Review Software suffers from a cross-site scripting vulnerability that originates from the presence of cross-site...

CVE-2021-4238

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by...

CVE-2021-4238 Insufficient randomness in github.com/Masterminds/goutils

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by...

CVE-2022-45891

Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads Upload2.ashx or access content uploaded by other users View.aspx after Ajax.asmx/SaveGrantAccessList...

Venganzas del Pasado 跨站脚本漏洞

Venganzas del Pasado is the source code for a website by Juan Schwindt, an individual developer. Venganzas del Pasado suffers from a cross-site scripting vulnerability that stems from thetitle parameter of several of its unknown functions that allows an attacker to implement cross-site scripting...