CVE-2023-0483

An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible for a project maintainer to extract a Datadog integration API key by modifying the site...

Arbitrary Code Execution

json-logic-js is vulnerable to Arbitrary Code Execution. The vulnerability exists in the jsonLogic function of logic.js due to improper sanitization to prevent prototype pollution in the operations object, which allows an attacker to execute malicious code on the system...

Security Patch Management Strengthens Ransomware Defense

With thousands of applications to manage, enterprises need an effective way to prioritize software security patches. That calls for a contextualized, risk-based approach and good overall attack surface risk management...

CVE-2023-27974

Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hosting provider when customer-website.example.com is visited. NOTE: the vendor's position is that "Auto-fill on page load" is not enabled by default...

OSV-2023-153 Heap-use-after-free in ucl_hash_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56716 Crash type: Heap-use-after-free READ 8 Crash state: uclhashfunc khresizeuclhashnode khputuclhashnode...

@nestjs/core vulnerable to Information Exposure via StreamableFile pipe

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open...

CVE-2023-0734 Improper Authorization in wallabag/wallabag

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4...

DSA-5369-1 syslog-ng - security update

Bulletin has no description...

CVE-2023-27560

Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields...

CVE-2023-1170 Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376...

CVE-2023-1106 Cross-site Scripting (XSS) - Reflected in flatpressblog/flatpress

Cross-site Scripting XSS - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3...

ASB-A-193434313

Bulletin has no description...

PUB-A-253770924

In smsGetTpPiIe of smsPduCodec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-264831217

There is a use-after-free issue in vha0, this could lead to local denial of service...

PUB-A-264261868

In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code...

PUB-A-244569778

In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-22996

In the Linux kernel before 5.17.2, drivers/soc/qcom/qcomaoss.c does not release an offinddevicebynode reference after use, e.g., with putdevice...

MAL-2023-3254 Malicious code in esqproofrandommine (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 024f1e40989828c5b2cf0a5b3ee159d5a562b9a46074f5e8410d570bbfea6094 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-7103 Malicious code in tphackedrandhydra (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a5d96cb29e21a4fff6805fb203b475e7ef5de8cf008c3edbe295953e177ba643 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-3230 Malicious code in esqpostinfostr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 61d866fa994654813c8b81aad534f70afc2b8ed265d3dd747c89daf7e7d5d16d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...