CVE-2023-40583

CVE-2023-40583 affects go-libp2p (libp2p Go implementation). A malicious actor can inject signed peer records to a remote node, causing unbounded memory growth in the victim’s node and eventual crash due to out-of-memory (OOM). The issue is explicitly documented as memory retention with no automa...

CVE-2023-40579

OpenFGA OpenFGA v1.3.0 and earlier contains an authorization bypass in the ListObjects API when models include expressions of type rel1 from type1. The root cause is mis-evaluation of results for ListObjects under those models, enabling access to unauthorized objects. The issue has been fixed in ...

Pyramid static view path traversal up one directory

Impact This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be...

CVE-2023-40570 Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users

Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as datasette-auth-passwords. The /-/ap...

CVE-2023-40570 Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users

Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as datasette-auth-passwords. The /-/ap...

Dell Client BIOS Improper Authentication (DSA-2023-190)

The Dell BIOS on the remote device is missing a security patch and is, therefore, affected by a improper authentication vulnerability.A malicious user with physical access to the system may potentially exploit this vulnerability in order to modify a security-critical UEFI variable without knowled...

Dell Client BIOS TOCTOU (DSA-2023-152)

The Dell BIOS on the remote device is missing a security patch and is, therefore, affected by a Time-of-check Time-of-use vulnerability. A local authenticated malicious user with physical access to the system could potentially exploit this vulnerability by using a specifically timed DMA transacti...

CVE-2023-40573

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a documen...

CVE-2023-40573 XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a documen...

Cisco Nexus 3000 9000 Series Switches SFTP Server File Access (cisco-sa-nxos-sftp-xVAp5Hfd)

According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

CVE-2023-40178 @node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an...

CVE-2023-40025

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has already expired. The most...

GHSA-JXCX-3H54-QQXX SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE

TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin. Only Silverstripe CMS 4 is affected by these vulnerabilities. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release...

SUSE-SU-2023:3397-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2023-3817: Fixed a potential DoS due to excessive time spent checking DH q parameter value. bsc1213853 - Don't pass zero length input to EVPCipher because s390x assembler optimized AES cannot handle zero size. bsc1213517...

PT-2023-5262

Name of the Vulnerable Software and Affected Versions djvulibre version 3.5.28 Description The issue is related to a lack of check for division by zero in the IW44Image.cpp component of the djvulibre library, which allows attackers to cause a denial of service. This can be exploited by a remote...

F5 Networks BIG-IP : Python urllib.parse vulnerability (K000135921)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3 / 17.5.1. It is, therefore, affected by a vulnerability as referenced in the K000135921 advisory. An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by...

PT-2023-29268 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.6.8 Description: The issue is related to Cross-site Scripting XSS - Reflected, which has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie...

SUSE-SU-2023:3361-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: - CVE-2023-20569: Fixed AMD 19h ucode to mitigate a side channel vulnerability in some of the AMD CPUs. bsc1213287...

SUSE-SU-2023:3358-1 Security update for samba

This update for samba fixes the following issues: - CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend bsc1213174. Bugfixes: - Fixed trust relationship failure bsc1213384...

SUSE-SU-2023:3344-1 Security update for postgresql15

This update for postgresql15 fixes the following issues: - Update to 13.12 - CVE-2023-39417: Fixed potential SQL injection for trusted extensions. bsc1214059...