CVE-2023-38428 affecting package kernel for versions less than 5.15.122.1-2

CVE-2023-38428 affecting package kernel for versions less than 5.15.122.1-2. A patched version of the package is available...

CVE-2023-23003 affecting package kernel for versions less than 5.15.118.1-2

CVE-2023-23003 affecting package kernel for versions less than 5.15.118.1-2. A patched version of the package is available...

CVE-2023-35826 affecting package kernel for versions less than 5.15.122.1-2

CVE-2023-35826 affecting package kernel for versions less than 5.15.122.1-2. A patched version of the package is available...

CVE-2023-33285 affecting package qt5-qtbase for versions less than 5.12.11-9

CVE-2023-33285 affecting package qt5-qtbase for versions less than 5.12.11-9. A patched version of the package is available...

CVE-2022-45919 affecting package kernel for versions less than 5.15.122.1-2

CVE-2022-45919 affecting package kernel for versions less than 5.15.122.1-2. A patched version of the package is available...

Design/Logic Flaw

Notes is a note-taking app for Nextcloud, an open-source cloud platform. Starting in version 4.4.0 and prior to version 4.8.0, when creating a note file with HTML, the content is rendered in the preview instead of the file being offered to download. Nextcloud Notes app version 4.8.0 contains a...

Code injection

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a user can access files inside a subfolder of a groupfolder accessible to them, even if advanced...

Code injection

useroidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also...

libxml2 security update

2.9.7-16.1 - Fix CVE-2023-28484 2185994 - Fix CVE-2023-29469 2185984...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the...

CLSA-2023-1691576572 Fix CVE(s): CVE-2023-34966

SECURITY UPDATE: infinite loop vulnerability in mdssvc RPC service for Spotlight - debian/patches/CVE-2023-34966.patch: prevents an infinite loop by preventing subcount less than 1. Add test for addressed CVE. - CVE-2023-34966...

CLSA-2023-1691576181 Fix CVE(s): CVE-2023-34966

SECURITY UPDATE: infinite loop vulnerability in mdssvc RPC service for Spotlight - debian/patches/CVE-2023-34966.patch: prevents an infinite loop by preventing subcount less than 1. Add test for addressed CVE. - CVE-2023-34966...

WordPress WP Project Manager Plugin <= 2.6.4 is vulnerable to Broken Access Control

Software WP Project Manager Type Plugin Vulnerable versions = 2.6.4 Fixed in 2.6.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-3636 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID dbb52708f7ad Credits István Márton Required...

PT-2023-25533 · Unknown · Kunduz - Homework Helper App

Name of the Vulnerable Software and Affected Versions: Kunduz - Homework Helper App versions prior to 6.2.3 Description: The issue affects the Kunduz - Homework Helper App, allowing for authentication abuse and authentication bypass due to the use of a hard-coded cryptographic key. This enables...

2023-08 Cumulative security Hotpatch for Azure Stack HCI, version 21H2 and Windows Server 2022 Datacenter: Azure Edition for x64-based Systems (KB5029367)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information...

PT-2023-4514 · Phoenix Contact +1 · Phoenix Contact Wp 6Xxx Series Web Panels +1

Name of the Vulnerable Software and Affected Versions: PHOENIX CONTACT WP 6xxx series web panels versions prior to 4.0.10 Description: A remote attacker with low privileges can gain limited read-access to the device-filesystem within the embedded Qt browser. The issue is related to errors in...

thunderbird security update

102.14.0-1.0.1 - Update to 102.14.0 build1...

CVE-2023-39529

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

Code injection

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are ...

Code injection

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...