GHSA-MXC9-G6M4-2V35 Magento Open Source allows Improper Neutralization of Special Elements Used

Adobe Commerce versions 2.4.6-p1 and earlier, 2.4.5-p3 and earlier and 2.4.4-p4 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated...

GHSA-RPV2-G4PC-WP72 Magento Open Source allows XML Injection

Adobe Commerce versions 2.4.6-p1 and earlier, 2.4.5-p3 and earlier and 2.4.4-p4 and earlier are affected by a XML Injection aka Blind XPath Injection vulnerability that could lead in minor arbitrary file system read. Exploitation of this issue does not require user interaction...

Command Injection

scancodeio is vulnerable to Command Injection. The vulnerability exists due to the lack of validation in the dockerreference parameter of the fetchdockerimage function of fetch.py, which allows an attacker to append malicious commands through the docker fetch process...

.NET and Visual Studio Denial of Service Vulnerability

...

PT-2023-19182 · Creative Solutions.Net +1 · Creative Gallery Component For Joomla +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to an SQL Injection vulnerability due to the improper neutralization of special elements used in an SQL command. This allows for SQ...

PT-2023-35506 · Tryton · Tryton

Name of the Vulnerable Software and Affected Versions: trytond versions prior to 6.0.34 Description: The issue is related to a security bugfix release. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was...

PT-2023-24849 · Joseph C Dolson · My Content Management

Name of the Vulnerable Software and Affected Versions: Joseph C Dolson My Content Management plugin versions 1.7.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions...

OSV-2022-1280 Heap-buffer-overflow in Canvas5Structure::NIBDecoder::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61081 Crash type: Heap-buffer-overflow READ 1 Crash state: Canvas5Structure::NIBDecoder::decode Canvas5Structure::decodeZone5 Canvas5Parser::decode...

Cross-site Scripting (XSS) in CrafterCMS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27...

SUSE-SU-2023:3174-1 Security update for mariadb

This update for mariadb fixes the following issues: - CVE-2022-32084: Fixed segmentation fault via the component subselect bsc1201164...

Arbitrary Code Execution

libopenbabel.so is vulnerable to Arbitrary Code Execution. The vulnerability exists due to the lack of validation in the ReadMolecule function of mopacformat.cpp, which allows an attacker to inject and execute malicious code into the system...

CVE-2023-4005 Insufficient Session Expiration in fossbilling/fossbilling

Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5...

CVE-2023-33534

CVE-2023-33534 concerns a CSRF in Guanzhou Tozed Kangwei Intelligent Technology’s ZLTS10G S10G_3.11.6. The issue arises via a crafted POST to the API endpoint /goform/goform_set_cmd_process, potentially allowing an attacker to takeover a user’s account. Documents consistently name the affected pr...

MAL-2023-8011 Malicious code in awell-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f22989168c34b37227bb7bcfe0b03c27cd141f8ec26d34a78a0c0ba06553f881 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

MAL-2023-8021 Malicious code in developer_backup_test527 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 873572cb006dd8216d097e1014bc26f4f54e2e57b00c4ed5db617993287c9735 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

DLA-3511-1 amd64-microcode - security update

Bulletin has no description...

MAL-2023-521 Malicious code in imposter-pkg-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e5127f46671b090bf9ac113a3ff87f19d522e0ec80dda844332b9625b30ecf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-31454

Yii 2 v2.0.45 was discovered to contain a cross-site scripting XSS vulnerability via the endpoint /books. NOTE: this is disputed by the vendor because the cve-2022-31454-8e8555c31fd3 page does not describe why /books has a relationship to Yii 2...

CVE-2023-38671

Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible...

PT-2023-26542 · Unknown · Paddlepaddle

Name of the Vulnerable Software and Affected Versions: PaddlePaddle versions prior to 2.5.0 Description: The issue is related to a use after free condition in the paddle.diagonal function. This resulted in a potentially exploitable condition. Recommendations: For versions prior to 2.5.0, update t...