Fedora 39 : openvpn (2023-d9d55a0bfc)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d9d55a0bfc advisory. This is an extended update of the OpenVPN 2.6.7 release which contains security fixes for CVE-2023-46849 and CVE-2023-46850. That release had a...

The vulnerability of the TranslationVectors Parser component of the Open Babel file-format conversion software allows a hacker to execute arbitrary code.

The vulnerability of the TranslationVectors Parser software’s file format conversion module for chemical substances in Open Babel is related to buffer overflow attacks. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

CVE-2023-48230

Cap'n Proto is a data interchange format and capability-based RPC system. In versions 1.0 and 1.0.1, when using the KJ HTTP library with WebSocket compression enabled, a buffer underrun can be caused by a remote peer. The underrun always writes a constant value that is not attacker-controlled,...

CVE-2023-38882

A reflected cross-site scripting XSS vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in 'ForExport.php'...

Command injection

Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system OS command injection, which could allow remote code execution...

PT-2023-30285 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: PublicCMS version 4.0.202302.e Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function. This is due to the deserialization of untrusted data. Recommendations: For PublicCMS...

Open Solutions For Education openSIS Security Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, Inc. A security vulnerability exists in Open Solutions For Education openSIS Classic Community Edition v9.0, which originates from a Reflective Cross-Site Scripting XSS...

Open Solutions For Education openSIS Security Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions For Education, Inc. A security vulnerability exists in Open Solutions For Education openSIS Classic Community Edition v9.0, which originates from a Reflective Cross-Site Scripting XSS...

Command injection

CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command...

SUSE CVE-2023-46850

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer...

PT-2023-30561 · Cubecart · Cubecart

Name of the Vulnerable Software and Affected Versions: CubeCart versions prior to 6.5.3 Description: The issue allows a remote authenticated attacker with administrative privileges to execute an arbitrary OS command. Recommendations: For versions prior to 6.5.3, update to version 6.5.3 or later t...

Ray OS Command Injection vulnerability

A command injection exists in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication...

GHSA-H3XG-WV58-5P43 Ray OS Command Injection vulnerability

A command injection exists in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication...

CVE-2023-6019

A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

Command injection

A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

SUSE CVE-2023-44441

GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...

PT-2023-32479 · H2O · H2O

Name of the Vulnerable Software and Affected Versions: H2O affected versions not specified Description: The issue allows an attacker to gain remote code execution on a server hosting the H2O dashboard. This is achieved through the POJO model import feature. Recommendations: At the moment, there i...

Ubuntu 23.04 / 23.10 : OpenVPN vulnerabilities (USN-6484-1)

The remote Ubuntu 23.04 / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6484-1 advisory. It was discovered that OpenVPN incorrectly handled the --fragment option in certain configurations. A remote attacker could possibly use this issue t...

The vulnerability of the WP Fastest Cache plugin of the WordPress content management system allows attackers to execute arbitrary SQL queries.

The vulnerability of the WP Fastest Cache plugin of the WordPress content management system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

XWiki < 14.10.6, 15.0-rc-1 < 15.1 Privilege Escalation Vulnerability (GHSA-35j5-m29r-xfq5)

Xwiki is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescripti...