CVE-2023-42917 vulnerabilities

Vulnerabilities for packages: openjdk-8-openj9, openjdk...

Use-After-Free

xorg-server is vulnerable to Use-After-Free. The vulnerability is triggered by warping the pointer between screens during shutdown or reset which could allow attackers to escalate privileges or crash the server...

CVE-2023-47848 WordPress Tainacan Plugin <= 0.20.4 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tainacan.Org Tainacan allows Reflected XSS.This issue affects Tainacan: from n/a through 0.20.4...

BELL-CVE-2023-49083

Bulletin has no description...

CISA Releases First Secure by Design Alert

Today, CISA published guidance on How Software Manufacturers Can Shield Web Management Interfaces From Malicious Cyber Activity as a part of a new Secure by Design SbD Alert series. This SbD Alert urges software manufacturers to proactively prevent the exploitation of vulnerabilities in web...

[20240201] - Core - Insufficient session expiration in MFA management views

The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...

CVE-2023-24023

Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to discovery of the encryption key and live injection, aka BLUFFS...

MAL-2023-8625 Malicious code in @ukncsc/my-ncsc-ui-common-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9535a39a8207d1d902daf4cfaaad312cc4bae19928fa3d2311e2be1f0ec9b027 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2023:4588-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 115.5.0 MFSA 2023-52 bsc1217230 CVE-2023-6204: Out-of-bound memory access in WebGL2 blitFramebuffer CVE-2023-6205: Use-after-free in MessagePort::Entangled CVE-2023-6206: Clickjacking permission prompts using the...

CVE-2023-42366

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the nexttoken function at awk.c:1159...

DLA-3668-1 opensc - security update

Bulletin has no description...

CVE-2023-6293 Prototype Pollution in robinbuschmann/sequelize-typescript

Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6...

SUSE-SU-2023:4544-1 Security update for squid

This update for squid fixes the following issues: - CVE-2023-46728: Remove gopher support bsc1216926. - Fixed overread in HTTP request header parsing bsc1217274...

CVE-2023-49208

scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration...

CVE-2023-47380

Admidio v4.2.12 and below is vulnerable to Cross Site Scripting XSS...

CVE-2023-36013

PowerShell Information Disclosure Vulnerability...

BELL-CVE-2023-5981

Bulletin has no description...

BELL-CVE-2023-48232

Bulletin has no description...

BELL-CVE-2023-48236

Bulletin has no description...

sharp vulnerability in libwebp dependency CVE-2023-4863

Overview sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. Who does this affect? Almost anyone processing untrusted input with versions of sharp prior to 0.32.6. How to resolve...