eap-7: heap exhaustion via deserialization

A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result i...

Red Hat EAP 7 Security Vulnerability

Red Hat EAP 7 is a middleware platform from Red Hat, Inc. built on open standards and compatible with the Java EE 7 specification. A security vulnerability exists in Red Hat EAP 7, which stems from a flaw found in the deserialization of certain classes that allows instantiation of HashMap and...

USN-6417-1 linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities

It was discovered that the eBPF implementation in the Linux kernel contained a race condition around read-only maps. A privileged attacker could use this to modify read-only maps. CVE-2021-4001 It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash...

CVE-2023-38396 WordPress Google Map Shortcode Plugin <= 3.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Alain Gonzalez plugin = 3.1.2 versions...

CVE-2023-38396 WordPress Google Map Shortcode Plugin <= 3.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Alain Gonzalez plugin = 3.1.2 versions...

WordPress Open User Map | Everybody can add locations Plugin <= 1.3.26 is vulnerable to Cross Site Scripting (XSS)

Software Open User Map | Everybody can add locations Type Plugin Vulnerable versions = 1.3.26 Fixed in 1.3.27 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-45056 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b19299929197...

WordPress Interactive World Map Plugin <= 3.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Interactive World Map Type Plugin Vulnerable versions = 3.2.0 Fixed in 3.4.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-45060 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 6813111c7df8 Credits Mika Required...

WordPress Plugin google-map-shortcode Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress WP Bing Map Pro Plugin < 5.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Bing Map Pro Type Plugin Vulnerable versions 5.0 Fixed in 5.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-45052 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID df665f7d8d54 Credits Mika Required privilege...

Fortinet FortiProxy's map server (FG-IR-22-468)

The version of FortiProxy installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-468 advisory. - An improper certificate validation vulnerability CWE-295 in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through...

WordPress WP GPX Map Plugin <= 1.7.08 is vulnerable to Broken Access Control

Software WP GPX Map Type Plugin Vulnerable versions = 1.7.08 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-44234 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 03364e36fe8f Credits Abdi Pranata Required privilege...

PYSEC-2023-179

This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke and pydash.collections.invokemap accept dotted paths Deep Path Strings to target a nested Python object, relative to the original source object. These paths can be used to target...

PT-2023-25270 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a logic error in the code of devicemem server.c, specifically in the DevmemIntMapPages function. This error could lead to a...

WordPress plugin Travel Map cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-41860 WordPress Travel Map Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Unauth. Cross-Site Scripting XSS vulnerability in TravelMap plugin = 1.0.1 versions...

Important: firefox

Issue Overview: The Mozilla Foundation describes this issue as follows: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. CVE-2023-1945 The Mozilla Foundation describes this issue as follows: A website could have obscured...

Command Injection

Overview pydash is a The kitchen sink of Python utility libraries for doing "stuff" in a functional way. Based on the Lo-Dash Javascript library. Affected versions of this package are vulnerable to Command Injection. A number of pydash methods such as pydash.objects.invoke and...

WordPress Extensions for Leaflet Map Plugin <= 3.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Extensions for Leaflet Map Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5050 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID acc5ac62f7be Credits Lana Codes...

The vulnerability of the Item_field::used_tables/update_depend_map_for_order component of the MariaDB database management system, which allows a hacker to trigger a service failure.

The vulnerability of the Itemfield::usedtables/updatedependmapfororder component of the MariaDB database management system is related to the use of the assert function or similar operators. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

PT-2023-27762

Name of the Vulnerable Software and Affected Versions AccessControl versions prior to 4.4 AccessControl versions prior to 5.8 AccessControl versions prior to 6.2 Description The issue arises from Python's "format" functionality, which allows someone controlling the format string to access objects...