BELL-CVE-2023-32681

Bulletin has no description...

CVE-2023-2881 Storing Passwords in a Recoverable Format in pimcore/customer-data-framework

Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10...

GHSA-W7JW-Q4FG-QC4C vulnerabilities

Vulnerabilities for packages: goreleaser...

DSA-5409-1 libssh - security update

Bulletin has no description...

CVE-2023-2832 SQL Injection in unilogies/bumsys

SQL Injection in GitHub repository unilogies/bumsys prior to 2.2.0...

CVE-2023-2838 Out-of-bounds Read in gpac/gpac

Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2...

CVE-2023-24832

A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only exploitable in cases where Hermes is used to execut...

CVE-2023-32099 Key duplication in GSDK

Compiler removal of buffer clearing in slisesignhash in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM...

Identifying a Patch Management Solution: Overview of Key Criteria

Software is rarely a one-and-done proposition. In fact, any application available today will likely need to be updated – or patched – to fix bugs, address vulnerabilities, and update key features at multiple points in the future. With the typical enterprise relying on a multitude of applications,...

MGASA-2023-0164 Updated python-pillow packages fix security vulnerability

libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. CVE-2022-30595 Improper Handling of Highly Compressed GIF Data Data Amplification. CVE-2022-45198...

DLA-3421-1 thunderbird - security update

Bulletin has no description...

OSV-2023-397 Heap-buffer-overflow in json_write_TF

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58915 Crash type: Heap-buffer-overflow READ 1 Crash state: jsonwriteTF jsonpreR13headerwriteprivate dwgwritejson...

MAL-2023-1212 Malicious code in innotecsaludo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c0835a79941b28db8905c92debfa5937bc9bb5707163402d7b82630d5f35fd14 The OpenSSF Package Analysis project identified 'innotecsaludo' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2023-27237

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack...

PT-2023-18953 · Sick · Sick Flexi Classic +1

Name of the Vulnerable Software and Affected Versions: SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 1044074, 1099830, 1099832, 1127717, 1069070, 1112296, 1051432, 1102420, 1127487, 1121596, 1121597 Description: The issue allows an...

Malicious code in the-four-tendencies-the-indispensable-personality-profiles-that-reveal-how-to-make-your-life-better- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3e9297cd32e9acc254a75e4a5d526916cc24499d026cbc04de40218284ff849 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-G947-422M-HR7P Duplicate Advisory: Pimcore Cross-site Scripting (XSS) in Static Routes name field

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mhpj-7m7h-8p6x. This link is maintained to preserve external references. Original Description Cross-site Scripting XSS - Generic in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2023-31556

podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent...

CVE-2023-31979

Catdoc v0.95 was discovered to contain a global buffer overflow via the function processfile at /src/reader.c...

Arbitrary File Upload

kiwitcms is vulnerable to Arbitrary File Upload. The vulnerability exists because the library does not properly validate files uploaded, allowing an attacker to bypass the file upload restrictions by uploading a malicious .exe file or embedded JavaScript file, tricking people into clicking on the...