GHSA-P6XQ-9H8R-V544 CodenameOne Pending Intent vulnerability

A vulnerability was found in CodenameOne 7.0.70. The manipulation leads to use of implicit intent for sensitive communication. It is possible to launch the attack remotely. Upgrading to version 7.0.71 is able to address this issue. The name of the patch is dad49c9ef26a598619fc48d2697151a02987d478...

CVE-2023-22792

A regular expression based DoS vulnerability in Action Dispatch 6.0.6.1, 6.1.7.1, and 7.0.4.1. Specially crafted cookies, in combination with a specially crafted XFORWARDEDHOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process...

CVE-2023-24977 Apache InLong: Jdbc Connection causes arbitrary file reading in InLong

Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7214...

PT-2023-19850 · Apache · Apache Inlong

Name of the Vulnerable Software and Affected Versions: Apache InLong versions 1.1.0 through 1.5.0 Description: The issue is an Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong. Users are advised to upgrade to Apache InLong's latest version or cherry-pick a specific pat...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Apache Tomcat

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Apache Tomcat. Vulnerability Details CVEID:CVE-2022-42252 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling, caused by the failure to reject a request containing an invalid...

CVE-2023-0266

A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRVCTLIOCTLELEMREAD|WRITE32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past...

CVE-2023-0240 Use after free in io_uring in the Linux Kernel

There is a logic error in iouring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the ioprepasyncwork function the assumption that the last iograbidentity call cannot return false is not true, and in this case the function will use...

GSD-2023-1001480 bpf: Fix slot type check in check_stack_write_var_off

bpf: Fix slot type check in checkstackwritevaroff This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

RLSA-2023:0050 Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 14.21.1, nodejs-nodemon 2.0.20. Security Fixes: minimist: prototype pollution...

GHSA-CP2P-6XH4-JMCP nterchange Code Injection vulnerability

A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/codecallercontroller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/ leads to code injection. The exploit has...

CVE-2021-4283

A vulnerability was found in FreeBPX voicemail. It has been rated as problematic. Affected by this issue is some unknown functionality of the file views/ssettings.php of the component Settings Handler. The manipulation of the argument key leads to cross site scripting. The attack may be launched...

PT-2022-11600 · Unknown · Kapetan Dns

Name of the Vulnerable Software and Affected Versions: kapetan dns versions up to 6.1.0 Description: A vulnerability was found in the DNS/Protocol/Request.cs file, leading to insufficient entropy in prng. The attack may be launched remotely. The issue is rated as problematic. Recommendations: For...

PT-2022-27997 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions prior to 0.8.2 Description: An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' issue allows logged-in users to execute arbitrary javascript in other users' browsers. Recommendations:...

Storefront Console crashes when clicking configuration at node Manage Receiver for Web sites

Storefront Console crashes when clicking configuration at node Manage Receiver for Web sites.The Store Front has successfully upgraded from 7.15 to 2203 LTSR...

DSA-5301-1 firefox-esr - security update

Bulletin has no description...

CVE-2022-44638 affecting package pixman for versions less than 0.42.2-1

CVE-2022-44638 affecting package pixman for versions less than 0.42.2-1. An upgraded version of the package is available that resolves this issue...

PT-2022-27022 · Mingsoft · Mingsoft Mcms

Name of the Vulnerable Software and Affected Versions: Mingsoft MCMS versions up to 5.2.9 Description: A critical issue has been found, affecting an unknown function of the file /cms/category/list. The manipulation of the sqlWhere argument leads to sql injection, allowing for remote attacks...

CVE-2022-39331 Cross-site Scripting (XSS) in Nexcloud Desktop Client

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue...

Apache Dolphin Scheduler has insufficiently protected credentials

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher...

CVE-2022-45462 Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher...