PYSEC-2023-107

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. A path traversal directory traversal vulnerability affects fides versions lower than version 2.15.1, allowing...

PYSEC-2023-108

MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took...

UBUNTU-CVE-2023-36810

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of t...

CVE-2023-36469 Code injection through NotificationRSSService in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including...

WordPress Social Login And Register 7.6.4 Authentication Bypass

Description: WordPress Social Login and Register Discord, Google, Twitter, LinkedIn = 7.6.4 – Authentication Bypass Affected Plugin: WordPress Social Login and Register Discord, Google, Twitter, LinkedIn Plugin Slug: woocommerce-abandoned-cart Affected Versions: = 7.6.4 CVE ID: CVE-2023-2982 CVSS...

CVE-2023-2977 affecting package opensc 0.22.0-1

CVE-2023-2977 affecting package opensc 0.22.0-1. A patched version of the package is available...

CVE-2023-32762 affecting package qt5-qtbase 5.12.11-5

CVE-2023-32762 affecting package qt5-qtbase 5.12.11-5. A patched version of the package is available...

CVE-2023-28322 affecting package curl 7.88.1-1

CVE-2023-28322 affecting package curl 7.88.1-1. A patched version of the package is available...

CVE-2023-3159 affecting package kernel 5.10.183.1-1

CVE-2023-3159 affecting package kernel 5.10.183.1-1. A patched version of the package is available...

CVE-2023-3161 affecting package kernel 5.10.183.1-1

CVE-2023-3161 affecting package kernel 5.10.183.1-1. A patched version of the package is available...

CVE-2023-32763 affecting package qt5-qtbase 5.12.11-5

CVE-2023-32763 affecting package qt5-qtbase 5.12.11-5. A patched version of the package is available...

CVE-2023-31975 affecting package yasm 1.3.0-13

CVE-2023-31975 affecting package yasm 1.3.0-13. A patched version of the package is available...

CVE-2023-33460 affecting package yajl for versions less than 2.1.0-19

CVE-2023-33460 affecting package yajl for versions less than 2.1.0-19. A patched version of the package is available...

CVE-2022-3775 affecting package grub2 for versions less than 2.06-10

CVE-2022-3775 affecting package grub2 for versions less than 2.06-10. A patched version of the package is available...

CVE-2023-2603 affecting package libcap for versions less than 2.60-2

CVE-2023-2603 affecting package libcap for versions less than 2.60-2. A patched version of the package is available...

PT-2023-24192 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton affected versions not specified Description: BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions, a Server-Side Request Forgery SSRF vulnerability exists. Th...

Patched OpenSSH Exploited for IoT, Linux Cryptomining

By Deeba Ahmed According to Microsoft, the new campaign is ongoing and uses a backdoor to install a patched version of OpenSSH to hijack targeted devices. This is a post from HackRead.com Read the original post: Patched OpenSSH Exploited for IoT, Linux Cryptomining...

CVE-2023-34464 XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.2.1 until versions 14.4.8, 14.10.5, and 15.1RC1 of org.xwiki.platform:xwiki-platform-web and any version prior to 14.4.8, 14.10.5, and 15.1.RC1 of...

WordPress Contact Form to DB by BestWebSoft Plugin <= 1.7.1 is vulnerable to SQL Injection

Software Contact Form to DB by BestWebSoft Type Plugin Vulnerable versions = 1.7.1 Fixed in 1.7.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-36508 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID d7318d25ca7b Credits LEE SE HYOUNG hackintoanetwork...

FastAsyncWorldEdit vulnerable to Uncontrolled Resource Consumption

Coordinated Disclosure Timeline - 10.06.2023: Issue reported to IntellectualSites - 11.06.2023: Issue is acknowledged - 12.06.2023: Issue has been fixed - 22.06.2023: Advisory has been published Impacted version range Before 2.6.3 Details Proof of Concept As a user, do the following: 1. Select...