PT-2023-34052

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.86 Description A memory leak issue was discovered in the st of quadfs setup function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2023-34389

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.163 Description A memory leak issue was discovered in the st of quadfs setup function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2023-33612

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.16 Description A memory leak issue was discovered in the st of quadfs setup function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2023-34624

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.337 Description A memory leak issue was discovered in the st of quadfs setup function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2023-34733

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.337 Description The issue is related to a buffer overflow in the setup handler of the uvc gadget in the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations For...

PT-2023-33466

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.19 Description The issue arises when the early init dt scan memory function fails, leading to the execution of of/fdt: run soc memory setup. This could potentially have security implications, although the...

PT-2023-1180 · Oracle · Oracle Learning Management +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Setup component of the Oracle Learning Management product. This can be exploited by a remote attacker to...

CVE-2023-21852: Improper Access Control

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Setup. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Learning Management...

CVE-2022-4199

The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-4330 WP Attachments < 5.0.6 - Admin+ Stored XSS

The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WP Better Emails <= 0.4 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

MAL-2023-772 Malicious code in setup-maven (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 634144f43edb36e91854ad024939d4efd04c6f966d6b138514b404ef25c16538 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in setup-maven (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 634144f43edb36e91854ad024939d4efd04c6f966d6b138514b404ef25c16538 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-2065

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description The issue is related to a use-after-free flaw in the NFS filesystem in the Linux Kernel, specifically in the nfsd4 ssc setup dul function in fs/nfsd/nfs4proc.c. This flaw could allow a...

SUSE-SU-2023:0058-1 Security update for systemd

This update for systemd fixes the following issues: Fixing the following issues: - units: restore RemainAfterExit=yes in systemd-vconsole-setup.service - vconsole-setup: don't concat strv if we don't need to i.e. not in debug log mode - vconsole-setup: add more log messages - units: restore Befor...

PT-2023-15144 · WordPress · Royal Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons plugin for WordPress versions up to, and including, 1.3.59 Description: The issue is related to insufficient access control in the 'wpr final settings setup' AJAX action. This allows any authenticated user to finali...

PT-2025-13354

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential memory leak issue has been identified in the Linux kernel related to the cifs session setup. The problem occurs when the cifs ses::auth key.response is not properly freed...

CVE-2022-3855

The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Malicious PyPI Packages Using Cloudflare Tunnels to Sneak Through Firewalls

In yet another campaign targeting the Python Package Index PyPI repository, six malicious packages have been found deploying information stealers on developer systems. The now-removed packages, which were discovered by Phylum between December 22 and December 31, 2022, include pyrologin,...