13097 matches found
CVE-2023-43797 BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...
Information Disclosure
apacheairflowproviderscelery is vulnerable to Information Disclosure. An attacker is able to exploit this vulnerability by tricking a user into running an Airflow job that contains a malicious Celery task. The malicious task would then insert sensitive information into the Airflow logs as clear...
CVE-2023-46852
In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring...
BELL-CVE-2023-5717
Bulletin has no description...
CVE-2023-41983
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.1, Safari 17.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1. Processing web content may lead to a denial-of-service...
CVE-2023-32359
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2. A user's password may be read aloud by VoiceOver...
GHSA-MQ26-G339-26XF Command Injection in pip when used with Mercurial
When installing a package from a Mercurial VCS URL, e.g. pip install hg+..., with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the hg clone call e.g. --config. Controlling the Mercurial configuration can modify how and which...
SUSE-SU-2023:4163-1 Security update for netty, netty-tcnative
This update for netty, netty-tcnative fixes the following issues: - Updated netty to version 4.1.100: - CVE-2023-44487: Fixed a potential denial of service scenario via RST frame floods bsc1216169. - Updated netty-tcnative to version 2.0.62 Final...
GHSA-H454-RQ3M-89RC Wagtail CRX CodeRed Extensions vulnerable to Path Traversal
views.py in Wagtail CRX CodeRed Extensions formerly CodeRed CMS or coderedcms before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media...
BELL-CVE-2023-31122
Bulletin has no description...
BELL-CVE-2023-43622
Bulletin has no description...
CVE-2023-45662 Multi-byte read heap buffer overflow in stbi__vertical_flip in stb_image
stbimage is a single file MIT licensed library for processing images. When stbisetflipverticallyonload is set to TRUE and reqcomp is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger memc...
GHSA-C827-HFW6-QWVM vulnerabilities
Vulnerabilities for packages: berg, zed, pgcat, bat, zellij...
BELL-CVE-2023-35947
Bulletin has no description...
BELL-CVE-2023-38473
Bulletin has no description...
BELL-CVE-2023-33460
Bulletin has no description...
BELL-CVE-2023-33204
Bulletin has no description...
BELL-CVE-2023-30086
Bulletin has no description...
Pegasystem PEGA Platform Cross-Site Scripting Vulnerability
Pegasystem PEGA Platform is a suite of application development platforms from the US-based Pegasystem. The platform is used to develop applications such as BPM Business Process Management, Case Management, Real-time Decision Making and CRM Customer Relationship Management. A security vulnerabilit...