Android Automotive OS Update Bulletin—October 2023Stay organized with collectionsSave and categorize content based on your preferences.

The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2023-10-05 or later from the October 2023 Android Security Bulletin in addition to all issues in thi...

PT-2023-28932 · Unknown · Oscommerce

Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript via the title parameter in the "/admin/admin-menu/add-submit" endpoint. This can lead to...

CVE-2023-27371 affecting package libmicrohttpd for versions less than 0.9.76-1

CVE-2023-27371 affecting package libmicrohttpd for versions less than 0.9.76-1. An upgraded version of the package is available that resolves this issue...

GHSA-6JQW-JWF5-RP8H Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Impact In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was...

CVE-2023-4569 affecting package kernel for versions less than 5.15.131.1-2

CVE-2023-4569 affecting package kernel for versions less than 5.15.131.1-2. A patched version of the package is available...

Design/Logic Flaw

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event if they knew the room ID and event ID. Note that the users were not able to view the events, but simply mark it as read. This could be confusing as...

PT-2023-31971 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 2.0 Description: The issue is a Cross-site Scripting XSS - Reflected vulnerability in the GitHub repository microweber/microweber. This type of vulnerability allows an attacker to inject malicious scrip...

PT-2023-5782 · Acronis · Acronis Cyber Protect 15 +1

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 15 versions prior to build 35979 Description: The issue is related to the storage of sensitive information in cleartext, which can lead to the disclosure of sensitive information. This can potentially allow a remote...

CVE-2023-42453

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event if they knew the room ID and event ID. Note that the users were not able to view the events, but simply mark it as read. This could be confusing as...

CVE-2023-42453 Improper validation of receipts allows forged read receipts in matrix synapse

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event if they knew the room ID and event ID. Note that the users were not able to view the events, but simply mark it as read. This could be confusing as...

CVE-2023-40395

The CVE-2023-40395 entry concerns multiple Apple platforms (tvOS, iOS, iPadOS, macOS Monterey/Sonoma, watchOS) where an issue in cache handling could allow an app to access contacts. The NVD description states the problem was addressed with improved cache handling and lists fixed versions: tvOS 1...

CVE-2023-41968

The CVE-2023-41968 issue affects Apple platforms: macOS Ventura 13.6, macOS Monterey 12.7, macOS Sonoma 14, tvOS 17, watchOS 10, iOS 17 and iPadOS 17. Root cause is improved validation of symlinks, enabling an app to read arbitrary files. Remediations are included in the listed OS versions; no ex...

developers.4shared.com Open Redirect vulnerability OBB-3711337

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Critical JetBrains TeamCity Flaw Could Expose Source Code and Build Pipelines to Attackers

A critical security vulnerability in the JetBrains TeamCity continuous integration and continuous deployment CI/CD software could be exploited by unauthenticated attackers to achieve remote code execution on affected systems. The flaw, tracked as CVE-2023-42793, carries a CVSS score of 9.8 and ha...

SUSE-SU-2023:3753-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - Expand lang sub-package in spec file unconditionally to handle previous name change from WebKit2GTK-lang to WebKitGTK-lang. This change affected the automatic generated Requires tag on WebKit2GTK-%apiver, then getting out of sync of what's...

Code injection

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the PROJECTPATHRELEA...

CVE-2023-42812

CVE-2023-42812 affects Galaxy prior to version 22.05, exposing a server-side request forgery (SSRF) where the application server can issue arbitrary HTTP/HTTPS requests to internal hosts and read responses. Public documents consistently describe the vulnerability as a pre-22.05 issue, with 22.05 ...

CVE-2023-23363 QTS

A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2441 bui...

CVE-2023-23362 QTS, QuTS hero, QuTScloud

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build...

systeminformation SSID Command Injection Vulnerability

Impact SSID Command Injection Vulnerability Patches Problem was fixed with a parameter check. Please upgrade to version = 5.21.7, Version 4 was not affected Workarounds If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to wifiConnections, wifiNetworks string on...