SUSE SLES15 Security Update : kernel (Live Patch 3 for SLE 15 SP4) (SUSE-SU-2023:3063-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3063-1 advisory. This update for the Linux Kernel 5.14.21-1504002421 fixes several issues. The following security issues were fixed: - CVE-2023-35788: Fixed an...

SUSE SLES12 Security Update : kernel (Live Patch 38 for SLE 12 SP5) (SUSE-SU-2023:3069-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3069-1 advisory. This update for the Linux Kernel 4.12.14-122144 fixes several issues. The following security issues were fixed: - CVE-2023-3159: Fixed...

CVE-2023-38512

Cross-Site Request Forgery CSRF vulnerability in wpstream WpStream wpstream allows Cross Site Request Forgery.This issue affects WpStream: from n/a through = 4.5.4...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Wpstream WpStream – Live Streaming, Video on Demand, Pay Per View plugin = 4.5.4 versions...

Virtuozzo Hybrid Server 7.5 Update 5 (7.5.5-249)

Virtuozzo Hybrid Server 7.5 Update 5 introduces new features and provides stability and usability bug fixes. Additionally, it provides a new kernel 3.10.0-1160.90.1.vz7.200.7. Vulnerability id: PSBM-148279 Live migration of Windows 2008 Server R2 virtual machines between Virtuozzo Hybrid Server 7...

LSN-0096-1: Kernel Live Patch Security Notice

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service system crash ...

mumbailive.com Cross Site Scripting vulnerability OBB-3540597

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

openSUSE 15: libkpathsea6 / libptexenc1 / libsynctex2 / libtexlua53-5 / etc (SUSE-SU-2023:2284-2)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:2284-2 advisory. - CVE-2023-32700: Fixed arbitrary code execution in LuaTeX bsc1211389. Tenable has extracted the preceding description block directly from the SUSE security...

Important: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

The vulnerability of the axodraw2 component in the TeX Live typesetting system allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the axodraw2 component in the TeX Live typesetting system is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the io.popen() function in the luatex-core.lua component of LuaTeX desktop publishing systems, such as TeX Live and MiKTeX, allows a malicious actor to execute arbitrary commands.

The vulnerability of the io.popen function in the luatex-core.lua component of LuaTeX desktop publishing systems such as TeX Live and MiKTeX is related to the lack of measures to sanitize input data. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

WordPress WpStream – Live Streaming, Video on Demand, Pay Per View Plugin <= 4.5.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software WpStream – Live Streaming, Video on Demand, Pay Per View Type Plugin Vulnerable versions = 4.5.4 Fixed in 4.5.5 OWASP Top 10 A6: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-38512 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership...

Important: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

WordPress WPEForm Lite – Drag and Drop Live Form Builder for Contact, Payment & Quiz Forms Plugin <= 1.6.4 is vulnerable to Cross Site Scripting (XSS)

Software WPEForm Lite – Drag and Drop Live Form Builder for Contact, Payment & Quiz Forms Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.6.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownersh...

Important: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

WordPress Live Scores for SportsPress Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)

Software Live Scores for SportsPress Type Plugin Vulnerable versions = 1.9.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1a8a87c6e703 Credits Rafie Muhammad...

WordPress Live Drag and Drop Builder for Contact Form 7 Plugin < 1.2.6 is vulnerable to Cross Site Scripting (XSS)

Software Live Drag and Drop Builder for Contact Form 7 Type Plugin Vulnerable versions 1.2.6 Fixed in 1.2.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f8dcf6b85301 Credits Rafi...

WordPress Ajax Live Search Plugin For WordPress Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)

Software Ajax Live Search Plugin For WordPress Type Plugin Vulnerable versions = 2.3.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9b4d19a516fc Credits Rafie Muhamm...

WordPress Live TV Player – Worldwide Live TV Channels Player for WordPress Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Live TV Player – Worldwide Live TV Channels Player for WordPress Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

Oxeye warns of SSRF Vulnerability in Owncast, SQL Injection Flaws in EaseProbe

By Waqas Owncase is a self-hosted live video streaming software, while EaseProbe is a lightweight and standalone health status checking tool. This is a post from HackRead.com Read the original post: Oxeye warns of SSRF Vulnerability in Owncast, SQL Injection Flaws in EaseProbe...