Spring Authorization Server is on Spring Initializr!

Today, I'm excited to announce that you have a new superpower: creating applications with Spring Authorization Server on Spring Initializr! That's right, it's time to begin your OAuth2 journey and become the hero you always knew you could be! In this post, I'll explain how you can get the most fr...

PT-2023-24583 · Liferay · Plugin For Oauth 2.0 +2

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.41 through 7.4.3.52 Liferay DXP 7.4 update 41 through 52 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect...

Service Provider Management System v1.0 - SQL Injection

Exploit Title: Service Provider Management System v1.0 - SQL Injection Date: 2023-05-23 Exploit Author: Ashik Kunjumon Vendor Homepage: https://www.sourcecodester.com/users/lewa Software Link:...

PT-2023-24494 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: Netbox version 3.5.1 Description: A stored cross-site scripting XSS issue exists in the Create Provider Accounts function, specifically at the /circuits/provider-accounts/ API endpoint, allowing attackers to execute arbitrary web scripts or...

Veeam Explorer for Microsoft Teams Error: "Tab type is not supported"

Challenge The Tenants of a Service Provider, who has recently upgraded to Veeam Backup for Microsoft 365 version 7.0.0.3604 P20230512, may receive the following error when attempting to restore using Veeam Explorer for Microsoft Teams: Tab type is not supported. Cause This error occurs because th...

CVE-2023-33791

A stored cross-site scripting XSS vulnerability in the Create Provider Accounts /circuits/provider-accounts/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

SUSE SLES15 / openSUSE 15 Security Update : terraform-provider-null (SUSE-SU-2023:2261-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2261-1 advisory. - rebuild the package with the go 1.19 security release bsc1200441 bsc1209658. Tenable has extracted the preceding description...

SUSE-SU-2023:2261-1 Security update for terraform-provider-null

This update of terraform-provider-null fixes the following issues: - rebuild the package with the go 1.19 security release bsc1200441 bsc1209658...

PT-2023-36177 · Unknown · Terraform-Provider-Null

Name of the Vulnerable Software and Affected Versions: terraform-provider-null affected versions not specified Description: The issue is related to a security release in Go 1.19, which required a rebuild of the terraform-provider-null package. Recommendations: At the moment, there is no informati...

SUSE SLES15 / openSUSE 15 Security Update : terraform-provider-aws (SUSE-SU-2023:2253-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2253-1 advisory. - rebuild the package with the go 1.19 security release bsc1200441 bsc1209658. Tenable has extracted the preceding description...

SUSE-SU-2023:2253-1 Security update for terraform-provider-aws

This update of terraform-provider-aws fixes the following issues: - rebuild the package with the go 1.19 security release bsc1200441 bsc1209658...

java-17-openjdk bug fix update

An update is available for java-17-openjdk. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The java-17-openjdk packages provide the OpenJDK 17 Java Runtime...

[SECURITY] Fedora 37 Update: rust-afterburn-5.4.0-3.fc37

Simple cloud provider agent...

[SECURITY] Fedora 37 Update: nmstate-2.2.10-5.fc37

Nmstate is a library with an accompanying command line tool that manages host networking settings in a declarative manner and aimed to satisfy enterprise needs to manage host networking through a northbound declarative API and multi provider support on the southbound...

CVE-2023-2769

A vulnerability classified as critical has been found in SourceCodester Service Provider Management System 1.0. This affects an unknown part of the file /classes/Master.php?f=deleteservice. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely...

CVE-2023-2769 SourceCodester Service Provider Management System sql injection

A vulnerability classified as critical has been found in SourceCodester Service Provider Management System 1.0. This affects an unknown part of the file /classes/Master.php?f=deleteservice. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely...

RESTEasy: creation of insecure temp files

In RESTEasy the insecure File.createTempFile is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user...

Service Provider Management System SQL注入漏洞

Service Provider Management System is a web-based application developed by Carlo Montero, an individual developer. It is designed to provide dynamic websites for service provider companies. A SQL injection vulnerability exists in SourceCodester Service Provider Management System version 1.0, whic...

CVE-2023-32994

Jenkins SAML Single Sign OnSSO Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...

CVE-2023-32993

Jenkins SAML Single Sign OnSSO Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...