CVE-2023-44383 October CMS stored XSS by authenticated backend user with improper configuration

October is a Content Management System CMS and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This...

CVE-2023-44383

Summary: CVE-2023-44383 affects October CMS versions affected by stored XSS when SVGs are uploaded to the Media Manager. What’s affected: October CMS (versions 3.0–3.5.x per sources) where the media manager stores SVG files. Root cause: Inadequate validation/ sanitization of uploaded SVG content ...

CVE-2023-44383 October CMS stored XSS by authenticated backend user with improper configuration

October is a Content Management System CMS and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This...

Okta Discloses Broader Impact Linked to October 2023 Support System Breach

Identity services provider Okta has disclosed that it detected "additional threat actor activity" in connection with the October 2023 breach of its support case management system. "The threat actor downloaded the names and email addresses of all Okta customer support system users," the company sa...

October Cross-Site Scripting Vulnerability

October is an open source content management system CMS and web platform from October. A cross-site scripting vulnerability exists in October versions 3.0 through 3.5.2, which originates when SVG files are supported, and allows a user with access to the Media Manager, where SVG files are stored, ...

PT-2023-29217 · October · October

Name of the Vulnerable Software and Affected Versions: October versions prior to 3.4.15 Description: The issue allows an authenticated backend user with the editor.cms pages, editor.cms layouts, or editor.cms partials permissions to write specific Twig code and execute arbitrary PHP, despite...

CVE-2023-44383: Improper Neutralization of Input During Web Page Generation

October is a Content Management System CMS and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to the October 2023 CPU

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

Security Bulletin: Java SE issues disclosed in the Oracle October 2023 Critical Patch Update plus CVE-2023-5676

Summary This bulletin covers all applicable Java SE CVEs published by Oracle as part of their October 2023 Critical Patch Update plus CVE-2023-5676. For more information please refer to Oracle's October 2023 CPU Advisory and the X-Force database entries referenced below. Vulnerability Details...

Fedora 39 : dotnet6.0 (2023-1dd7cbebc9)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1dd7cbebc9 advisory. This is the October 24, 2023 release for .NET 6. Release Notes: https://github.com/dotnet/core/blob/main/release-notes/6.0/6.0.24/6.0.24.md Tenable has...

NVIDIA GPU Display Driver Advisory - October 2023 - Lenovo Support US

No description provided...

Fedora 39 : dotnet6.0 (2023-9f9c34f636)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-9f9c34f636 advisory. This the October 2023 monthly update for .NET 6 Release Notes: https://github.com/dotnet/core/blob/main/release-notes/6.0/6.0.23/6.0.23.md Tenable has...

Oracle Siebel < 19.9 (October 2019 CPU)

The remote Oracle Siebel install is affected by a vulnerability as referenced in the October 2019 CPU advisory: - Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM component: Install - Configuration. Supported versions that are affected are 19.8 and...

Threat Roundup for October 27 to November 3

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between Oct. 27 and Nov. 3. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

schreinerei-meerbothe.de Improper Access Control vulnerability OBB-3770760

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

p-diddy.com Cross Site Scripting vulnerability OBB-3770042

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

salihonurbasat.com Cross Site Scripting vulnerability OBB-3769981

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

redeempharmacy.com.my Cross Site Scripting vulnerability OBB-3769975

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

siamhealth.net Improper Access Control vulnerability OBB-3769895

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

kejora.gov.my Improper Access Control vulnerability OBB-3769826

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...