Advisory ROSA-SA-2023-2271

software: pdfbox 2.0.24 WASP: ROSA-CHROME packageevrstring: pdfbox-2.0.24-1.src.rpm CVE-ID: CVE-2021-27807 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A carefully crafted PDF file may cause an infinite loop when loading the file. This issue affects Apache PDFBox version 2.0.22 and earlier versions of...

PT-2023-29819 · Unknown · Qwerty23 Rocket Font Plugin

Name of the Vulnerable Software and Affected Versions: Qwerty23 Rocket Font plugin versions 1.2.3 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...

CVE-2023-38041 New client side release to address a privilege escalation on Windows user machines

Summary A vulnerability exists on all versions of the Ivanti Secure Access Client Below 22.6R1 that would allow an unprivileged local user to gain unauthorized elevated privileges on the affected system. Mitigation Currently None Resoluiton To resolve the below mentioned vulnerability upgrade you...

SUSE-SU-2023:4109-1 Security update for erlang

This update for erlang fixes the following issues: - Updated to version 23.3.4.19 jscPED-6209: - CVE-2022-37026: Complete a previous insufficient fix for an authentication bypass bsc1205318...

PT-2023-20094 · Ezoic · Ezoic Ampedsense – Adsense Split Tester

Name of the Vulnerable Software and Affected Versions: Ezoic AmpedSense – AdSense Split Tester plugin versions = 4.68 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowin...

CVE-2023-41752 Apache Traffic Server: s3_auth plugin problem with hash calculation

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue...

PT-2023-6344 · Oracle · Oracle Outside In Technology

Name of the Vulnerable Software and Affected Versions: Oracle Outside In Technology versions 8.5.6 Description: The issue exists due to insufficient input validation in the Content Access SDK, Image Export SDK, PDF Export SDK, and HTML Export SDK components of Oracle Outside In Technology. This...

PT-2023-6382 · Oracle · Oracle Analytics Bi Publisher

Name of the Vulnerable Software and Affected Versions: Oracle Analytics BI Publisher versions 6.4.0.0.0 through 7.0.0.0.0 Description: The issue is related to insufficient input validation in the Web Server component of Oracle BI Publisher. This allows a low-privileged attacker with network acces...

PT-2023-28380 · Unknown · Onsinview2

Name of the Vulnerable Software and Affected Versions: OnSinView2 versions 2.0.1 and earlier Description: An issue with improper restriction of operations within the bounds of a memory buffer exists. If exploited, this could lead to information disclosure or the execution of arbitrary code by...

PT-2023-6300 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.20 Oracle Database Server versions 21.3 through 21.11 Description: The issue is related to insufficient input validation in the Oracle Notification Server component of Oracle Database Server. Th...

GHSA-FPCF-QR79-HJQP SQL Injection in Apache InLong

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false records, making it harder to audit and trace malicious activities. Users are...

web2py vulnerable to OS command injection

Overview web2py web application framework contains an OS command injection vulnerability CWE-78. Masashi Yamane of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact When web2py is configured to u...

PT-2023-6415 · D Link · D-Link Di-7003Gv2 +4

Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 versions 23.08.25D1 and before D-Link DI-7100G+V2 versions 23.08.23D1 and before D-Link DI-7100GV2 version 23.08.23D1 D-Link DI-7200G+V2 versions 23.08.23D1 and before D-Link DI-7200GV2 versions 23.08.23E1 and before D-Link...

PT-2023-29624 · Mailmunch · Constant Contact Forms By Mailmunch

Name of the Vulnerable Software and Affected Versions: MailMunch Constant Contact Forms by MailMunch plugin versions = 2.0.10 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-29836 · WordPress · Mahlamusa Who Hit The Page – Hit Counter

Name of the Vulnerable Software and Affected Versions: Mahlamusa Who Hit The Page – Hit Counter plugin versions = 1.4.14.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application tha...

PT-2023-29630 · Pixelgrade · Pixfields

Name of the Vulnerable Software and Affected Versions: PixelGrade PixFields plugin versions prior to 0.7.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a we...

PT-2023-29619 · Unknown · Hassan Ali Snap Pixel Plugin

Name of the Vulnerable Software and Affected Versions: Hassan Ali Snap Pixel plugin versions = 1.5.7 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-6176 · D Link · Di-7300G +6

Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 versions 23.08.25D1 and earlier D-Link DI-7100G versions 23.08.23D1 and earlier D-Link DI-7100GV2 version 23.08.23D1 D-Link DI-7200G versions 23.08.23D1 and earlier D-Link DI-7200GV2 versions 23.08.23E1 and earlier D-Link...

PT-2023-29477 · Unknown · Matt Mckenny Stout Google Calendar Plugin

Name of the Vulnerable Software and Affected Versions: Matt McKenny Stout Google Calendar plugin versions = 1.2.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the use...

PT-2023-29586 · Unknown · Christopher Finke Feed Statistics

Name of the Vulnerable Software and Affected Versions: Christopher Finke Feed Statistics plugin versions = 4.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...