JVN#80476432: web2py vulnerable to OS command injection

web2py web application framework contains an OS command injection vulnerability CWE-78. Impact When web2py is configured to use notifySendHandler for logging not the default configuration, a crafted web request may execute an arbitrary OS command on the web server using the product. Solution Upda...

PT-2023-28686 · Dell · Dell Openmanage Server Administrator

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Server Administrator versions 11.0.0.0 and prior Description: The issue is related to an Improper Access Control vulnerability. A local low-privileged malicious user could potentially exploit this vulnerability to execute...

PT-2023-29366 · Unknown · Leadsquared Suite

Name of the Vulnerable Software and Affected Versions: LeadSquared Suite plugin versions = 0.7.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web application that...

PT-2023-32173 · Unknown · Frappe Lms

Name of the Vulnerable Software and Affected Versions: frappe/lms versions prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4 Description: The issue is related to Cross-site Scripting XSS, which is a type of security vulnerability that occurs when an attacker injects malicious scripts into a...

SUSE-SU-2023:4048-1 Security update for python-reportlab

This update for python-reportlab fixes the following issues: - CVE-2019-19450: Fixed an issue which allowed remote code execution via startunichar in paraparser.py evaluating untrusted user input. bsc1215560...

Out-of-bounds read vulnerability in Keyence KV STUDIO and KV REPLAY VIEWER

Overview KV STUDIO and KV REPLAY VIEWER provided by KEYENCE CORPORATION contain an out-of-bounds read vulnerability CWE-125, CVE-2023-42138. Michael Heinzl reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact If this vulnerability is exploited, information ma...

SUSE-SU-2023:4027-1 Security update for shadow

This update for shadow fixes the following issues: - CVE-2023-4641: Fixed potential password leak bsc1214806...

PT-2023-6599 · F5 · Big-Ip Edge Client Installer

Name of the Vulnerable Software and Affected Versions: BIG-IP Edge Client Installer versions prior to the fixed version Description: The issue is related to insufficient verification of data, which may allow an attacker to elevate their privileges during the installation process on macOS...

PT-2023-6005 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 7.0.0 through 7.0.11 Fortinet FortiOS versions 7.2.0 through 7.2.4 Description: The issue is related to an improper authorization vulnerability in Fortinet FortiOS, which may allow an attacker belonging to the...

PT-2023-6263 · Siemens · Tecnomatix Plant Simulation

Name of the Vulnerable Software and Affected Versions: Tecnomatix Plant Simulation V2201 versions prior to V2201.0009 Tecnomatix Plant Simulation V2302 versions prior to V2302.0003 Description: A vulnerability has been identified in the affected applications, which contain an out of bounds read...

KLA61363 Multiple vulnerabilities in Apache Tomcat

Multiple vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A denial of service vulnerability in HTTP/2 protocol can be...

PT-2023-6017 · Fortinet · Fortiwlm

Name of the Vulnerable Software and Affected Versions: Fortinet FortiWLM versions 8.5.0 through 8.5.4 Fortinet FortiWLM versions 8.6.0 through 8.6.5 Description: The issue is related to insufficient checking of arguments passed to a command, allowing a remote attacker to execute arbitrary code...

PT-2023-6120 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 118.0.5993.70 Description: The issue is related to an inappropriate implementation in Intents in Google Chrome, which allowed a remote attacker to bypass content security policy via a crafted HTML page. This...

PT-2023-5968 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 118.0.5993.70 Description: The issue is related to an inappropriate implementation in the Autofill feature of Google Chrome, which may allow a remote attacker to bypass autofill restrictions. This can be achiev...

PT-2023-28117 · Dotsquares · Dotsquares Wp Custom Post Template

Name of the Vulnerable Software and Affected Versions: Dotsquares WP Custom Post Template versions prior to 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on...

SUSE-SU-2023:4018-1 Security update for go1.20

This update for go1.20 fixes the following issues: - Updated to version 1.20.9 bsc1206346: - CVE-2023-39323: Fixed an arbitrary execution issue during build time due to path directive bypass bsc1215985...

Upgrading your Android device? Read this first

Last month, we wrote an article about what to do when upgrading your iPhone. Since then, we've received several requests to do a similar post about Android devices. Providing uniform and easy to follow instructions is a bit harder to do for Android, because there are many differences between make...

PT-2023-28039 · Unknown · Daext Live News

Name of the Vulnerable Software and Affected Versions: DAEXT Live News plugin versions = 1.06 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application...

Vulnerabilities fixed in Kofax Power PDF

Kofax has fixed vulnerabilities in Power PDF. A malicious person could exploit the vulnerabilities to execute arbitrary code with privileges of the victim, or to gain access to sensitive data. To do this, the malicious party must trick the victim into opening a malicious file to open, or follow a...

PT-2023-29161 · WordPress · Joakim Ling Remove Slug From Custom Post Type Plugin

Name of the Vulnerable Software and Affected Versions: Joakim Ling Remove slug from custom post type plugin versions 1.0.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintende...