CVE-2023-38734

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481...

Attackers demand ransoms for stolen LinkedIn accounts

An ongoing campaign targeting LinkedIn accounts has led to victims losing control of their accounts, or being locked out following repeated login attempts. Whether the attackers are using brute force methods or credential stuffing isn't known, but because some victims are being being locked out...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to permissions bypass, privilege escalation, key generation failure, denial of service and request smuggling due to vulnerabilities in Node.js

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to permissions bypass, privilege escalation, key generation failure, denial of service and request smuggling due to vulnerabilities in Node.js with details below. CVE-2023-30584, CVE-2023-30585,...

Join us for VeloCON 2023: Digging Deeper Together!

September 13, 2023 at 9 am ET Rapid7 is thrilled to announce that the 2nd annual VeloCON: Digging Deeper Together virtual summit will be held this September 13th at 9 am ET. Once again, the conference will be online and completely free! VeloCON is a one-day event focused on the Velociraptor...

Netflix Dispatch 安全漏洞

Netflix Dispatch is a US-based Netflix company's software that provides security event management with deep integration with Slack, GSuite, Jira, etc. tools. Netflix Dispatch suffers from a security vulnerability that stems from a server response that includes the JWT key used to sign JWT tokens ...

CVE-2023-39250

Dell Storage Integration Tools for VMware DSITV and Dell Storage vSphere Client Plugin DSVCP versions prior to 6.1.1 and Replay Manager for VMware RMSV versions prior to 3.1.2 contain an information disclosure vulnerability. A local low-privileged malicious user could potentially exploit this...

CVE-2023-39250

CVE-2023-39250 affects Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) prior to 6.1.1, and Replay Manager for VMware (RMSV) prior to 3.1.2. Root cause is an information disclosure vulnerability that could allow a local low-privileged attacker to re...

CVE-2023-39250

Dell Storage Integration Tools for VMware DSITV and Dell Storage vSphere Client Plugin DSVCP versions prior to 6.1.1 and Replay Manager for VMware RMSV versions prior to 3.1.2 contain an information disclosure vulnerability. A local low-privileged malicious user could potentially exploit this...

PT-2023-6517 · Dell · Dell Storage Integration Tools For Vmware +2

Name of the Vulnerable Software and Affected Versions: Dell Storage Integration Tools for VMware DSITV versions prior to 6.1.1 Dell Storage vSphere Client Plugin DSVCP versions prior to 6.1.1 Replay Manager for VMware RMSV versions prior to 3.1.2 Description: The issue is related to an informatio...

WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking Plugin <= 3.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking Type Plugin Vulnerable versions = 3.7.1 Fixed in 3.7.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-40561 Patch priority Low CVSS severity Low 5.4 Developer...

PT-2023-27227 · Unknown · Woodpecker

Name of the Vulnerable Software and Affected Versions: Woodpecker versions prior to 1.0.2 Description: An attacker can post malformed webhook data which leads to an update of the repository data, potentially allowing the takeover of a repository. This issue is critical if the CI is configured for...

Contributor License Agreement assistant Security Vulnerabilities

Contributor License Agreement assistant CLA assistant is a Javascript-based contributor agreement management software from the cla-assistant team that integrates with Github. The software provides the ability to ask contributors to sign a CLA when they pull code. The Contributor License Agreement...

SAP NetWeaver Process Integration Access Control Error Vulnerability (CNVD-2023-65180)

SAP NetWeaver Process Integration PI is an SAP enterprise application integration software from SAP, Germany, and is a component of the NetWeaver product group. The component is mainly used for the exchange of information between the internal system and the external. An access control error...

Security Bulletin: Kafka nodes in IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a denial of service due to snappy-java (CVE-2023-34453, CVE-2023-34455, CVE-2023-34454).

Summary Kafka nodes in IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a denial of service due to snappy-java CVE-2023-34453, CVE-2023-34455, CVE-2023-34454. The resolving fix includes Kafka 3.5.1 which includes snappy-java 1.1.10.1 Vulnerability Details CVEID:CVE-2023-34453...

[SECURITY] Fedora 38 Update: php-8.2.9-2.fc38

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

SUSE CVE-2023-39953

useroidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also...

Smart commits are processed in Jira for repositories without smart commits when synced via git webhooks

h3. Issue Summary This is reproducible on Data Center: yes Explanation: This bug shows up only for integration using webhooks. Smar commits works correctly when data is being synced during hourly polling job. Environment requirements: Jira needs to be available for Git instance to let git webhook...

[SECURITY] Fedora 37 Update: php-8.1.22-1.fc37

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

IBM InfoSphere Information Server Information Disclosure Vulnerability (CNVD-2023-68779)

IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. An information disclosure vulnerability exists in IBM InfoSphere Information Server version 11.7...

WordPress Printful Integration for WooCommerce Plugin <= 2.2.3 is vulnerable to Broken Access Control

Software Printful Integration for WooCommerce Type Plugin Vulnerable versions = 2.2.3 Fixed in 2.2.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-47168 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID aea11ad2ad30 Credits István...