Cross site request forgery (csrf)

The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on the epiosendautosuggestallowed function. This makes it possible for unauthenticated attackers to send allowed paramete...

CVE-2021-4405 ElasticPress <= 3.5.3 - Cross-Site Request Forgery Bypass

The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on the epiosendautosuggestallowed function. This makes it possible for unauthenticated attackers to send allowed paramete...

engine.io: Specially crafted HTTP request can trigger an uncaught exception

A flaw was found in engine.io. The Socket.IO Engine.IO is vulnerable to a denial of service caused by an uncaught exception flaw. By sending a specially-crafted HTTP request, a remote, authenticated attacker can cause the Node.js process to crash, resulting in a denial of service...

USN-6194-1 linux-oem-6.1 vulnerabilities

Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-35788, LP: 2023577 Xingyuan Mo and Gengjia Chen...

USN-6192-1 linux, linux-allwinner, linux-allwinner-5.19, linux-aws, linux-aws-5.19, linux-azure, linux-gcp, linux-gcp-5.19, linux-hwe-5.19, linux-ibm, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi, linux-starfive, linux-starfive-5.19 vulnerabilities

Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-35788, LP: 2023577 Xingyuan Mo and Gengjia Chen...

golang: runtime: unexpected behavior of setuid/setgid binaries

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state or assuming the status of standard I/O file descriptors. If a setuid/setgid binary is executed with standard I/...

A Bootiful Podcast: Elastic's Philipp Krenn

Hi Spring fans! Welcome to another installment of a Bootiful Podcast! In this installment, Josh Long talks to Elastic's Philipp Krenn, live from Spring IO 2023 in beautiful Barcelona, Spain!...

libvirt: Memory leak in virPCIVirtualFunctionList cleanup

A vulnerability was found in libvirt. This security flaw occurs due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's gautoptr cleanup...

PT-2023-8989 · Apple +1 · Apple Macos +1

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14 Description: The issue is related to a buffer out-of-bounds write in the Model I/O framework of the macOS operating system. It may allow an attacker to execute arbitrary code with the help of a specially crafted fil...

Denial Of Services (DoS)

json-io is vulnerable to Denial Of Services DoS. The vulnerability exists due a lack of nesting depth checks in the JsonParser.java, which allows an attacker to cause an application crash by passing the maliciously crafted JSON string...

GHSA-779H-3R69-4F5P json-io vulnerable to stack exhaustion

An issue was discovered json-io through 4.14.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies...

com.github.mkolisnyk:cucumber-reports (>=0.0.2, <=1.0.7) potentially affected by CVE-2023-34610 via com.cedarsoftware:json-io (2.2.31)

com.cedarsoftware:json-io MAVEN version 2.2.31 is affected by a known vulnerability. The following packages have a transitive dependency on com.cedarsoftware:json-io and may be impacted: - com.github.mkolisnyk:cucumber-reports =0.0.2, =1.0.7 Source cves: CVE-2023-34610 Source advisory:...

com.cedarsoftware:java-util (>=1.7.0, <=1.7.1), com.cedarsoftware:n-cube (>=2.0.0, <=2.0.1) potentially affected by CVE-2023-34610 via com.cedarsoftware:json-io (2.4.0)

com.cedarsoftware:json-io MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.cedarsoftware:json-io and may be impacted: - com.cedarsoftware:java-util =1.7.0, =2.0.0, =2.0.1 Source cves: CVE-2023-34610 Source advisory:...

com.cedarsoftware:java-util (1.8.4), com.cedarsoftware:n-cube (>=2.3.0, <=2.3.1) potentially affected by CVE-2023-34610 via com.cedarsoftware:json-io (2.4.5)

com.cedarsoftware:json-io MAVEN version 2.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.cedarsoftware:json-io and may be impacted: - com.cedarsoftware:java-util 1.8.4 - com.cedarsoftware:n-cube =2.3.0, =2.3.1 Source cves: CVE-2023-34610 Sourc...

com.cedarsoftware:java-util (1.9.0), com.cedarsoftware:n-cube (>=2.3.2, <=2.3.3) potentially affected by CVE-2023-34610 via com.cedarsoftware:json-io (2.5.1)

com.cedarsoftware:json-io MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.cedarsoftware:json-io and may be impacted: - com.cedarsoftware:java-util 1.9.0 - com.cedarsoftware:n-cube =2.3.2, =2.3.3 Source cves: CVE-2023-34610 Sourc...

com.cedarsoftware:n-cube (>=2.5.0, <=2.7.0), com.github.cafdataprocessing:composite-document (>=1.4.0-60, <=1.5.0-84) +23 more potentially affected by CVE-2023-34610 via com.cedarsoftware:json-io (2.6.0)

com.cedarsoftware:json-io MAVEN version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.cedarsoftware:json-io and may be impacted: - com.cedarsoftware:n-cube =2.5.0, =1.4.0-60, =1.2.0-43, =1.0.0-4, =1.0.0-4, =1.1.0-94, =1.0.0-4, =1.0.0-4,...

com.cedarsoftware:n-cube (>=2.9.4, <=2.9.18) potentially affected by CVE-2023-34610 via com.cedarsoftware:json-io (2.7.1)

com.cedarsoftware:json-io MAVEN version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.cedarsoftware:json-io and may be impacted: - com.cedarsoftware:n-cube =2.9.4, =2.9.18 Source cves: CVE-2023-34610 Source advisory: OSV:GHSA-779H-3R69-4F5P...

com.cedarsoftware:n-cube (3.1.0) potentially affected by CVE-2023-34610 via com.cedarsoftware:json-io (2.7.6)

com.cedarsoftware:json-io MAVEN version 2.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.cedarsoftware:json-io and may be impacted: - com.cedarsoftware:n-cube 3.1.0 Source cves: CVE-2023-34610 Source advisory: OSV:GHSA-779H-3R69-4F5P...

com.cedarsoftware:n-cube (>=3.1.2, <=3.1.3) potentially affected by CVE-2023-34610 via com.cedarsoftware:json-io (2.9.0)

com.cedarsoftware:json-io MAVEN version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.cedarsoftware:json-io and may be impacted: - com.cedarsoftware:n-cube =3.1.2, =3.1.3 Source cves: CVE-2023-34610 Source advisory: OSV:GHSA-779H-3R69-4F5P...

com.adobe.ride:ride-core (>=1.0.3, <=2.0.0), com.adobe.ride:ride-fuzzer-lib (2.0.0) +1 more potentially affected by CVE-2023-34610 via com.cedarsoftware:json-io (2.9.4)

com.cedarsoftware:json-io MAVEN version 2.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.cedarsoftware:json-io and may be impacted: - com.adobe.ride:ride-core =1.0.3, =2.0.0 - com.adobe.ride:ride-fuzzer-lib 2.0.0 -...