Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.15.1 ESR. Security Fixes: libwebp: Heap buffer overflow in WebP Codec CVE-2023-4863 For more details about the security issues, including the...

[SECURITY] Fedora 39 Update: firefox-117.0.1-2.fc39

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Revive Adserver 跨站脚本漏洞

Revive Adserver is an open source ad serving system that allows advertisers, publishers, and networks to place ads on multiple platforms e.g., websites, apps, video players and supports ad effectiveness tracking, campaign management, and placement rule definition. Revive Adserver suffers from a...

Fedora: Security Advisory (FEDORA-2023-8f8ddb2428)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

spider-flow code issue vulnerability

spider-flow is a crawler platform open source by sssssssss-team. Spider-flow 0.5.0 previous version of a code problem vulnerability , the vulnerability stems from the component API file src/main/java/org/spiderflow/controller/DataSourceController.java in the DriverManager. There is an unknown...

Fedora: Security Advisory for firefox (FEDORA-2023-c7af372e2e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PYSEC-2023-176

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...

PYSEC-2023-176

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...

CVE-2023-41043

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server...

CVE-2023-41042

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in...

CVE-2023-38507

Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12...

Design/Logic Flaw

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users...

Design/Logic Flaw

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server...

Design/Logic Flaw

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server...

Design/Logic Flaw

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in...

CVE-2023-41043

Discourse DoS CVE-2023-41043 affects the Discourse platform prior to 3.1.1 (stable) and 3.2.0.beta1 (beta/tests-passed). A malicious admin could generate extremely large icons sprites that are cached per server process, potentially triggering DoS downtime on multisite deployments. The issue is fi...

CVE-2023-41043 Discourse DoS via SvgSprite cache

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server...

CVE-2023-41042

CVE-2023-41042 affects the open‑source forum software Discourse. Prior to Discourse 3.1.1 (stable) and 3.2.0.beta1 (beta/tests-passed), importing a remote theme could load assets into memory without enforcing limits on file size or number of files. This could enable a DoS condition described acro...

CVE-2023-40588 Discourse DoS via 2FA and Security Key Names

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users...

CVE-2023-40588

CVE-2023-40588 affects Discourse (open-source discussion platform). A malicious user could add a 2FA or security key with a crafted name, causing a denial-of-service for other users. Affected versions: prior to 3.1.1 on the stable branch and 3.2.0.beta1 on the beta/tests-passed branches. Mitigati...