CVE-2023-0493 Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5...

DSA-5329-1 bind9 - security update

Bulletin has no description...

CVE-2023-0438 Cross-Site Request Forgery (CSRF) in modoboa/modoboa

Cross-Site Request Forgery CSRF in GitHub repository modoboa/modoboa prior to 2.0.4...

OPENSUSE-SU-2023:0027-1 Security update for tor

This update for tor fixes the following issues: tor 0.4.7.13: fix SafeSocks option to avoid DNS leaks boo1207110, TROVE-2022-002 improve congestion control fix relay channel handling tor 0.4.7.12: new key for moria1 new metrics are exported on the MetricsPort for the congestion control subsystem...

bumpalo has use-after-free due to a lifetime error in `Vec::into_iter()`

In affected versions of this crate, the lifetime of the iterator produced by Vec::intoiter is not constrained to the lifetime of the Bump that allocated the vector's memory. Using the iterator after the Bump is dropped causes use-after-free accesses. The following example demonstrates memory...

Pods < 2.9.11 - Pods Deletion via CSRF

The plugin does not have CSRF checks when deleting pods, which could allow attackers to make logged in admins perform such action via a CSRF attack...

Themify Portfolio Post < 1.2.2 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC themifyportfolioposts imageh='100"...

WordPress URL Shortener by MyThemeShop Plugin <= 1.0.17 is vulnerable to Broken Access Control

Software URL Shortener by MyThemeShop Type Plugin Vulnerable versions = 1.0.17 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23896 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID e643a0198210 Credits István Márt...

Denial Of Service (DoS)

mercurius is vulnerable to Denial of Service DoS attacks. A malicious user is able to cause an application crash via sending a malformed packet over WebSocket to /graphql resulting in Denial of Service...

CVE-2023-21882 vulnerabilities

Vulnerabilities for packages: mysql...

CVE-2023-21883 vulnerabilities

Vulnerabilities for packages: mysql...

CVE-2023-21887 vulnerabilities

Vulnerabilities for packages: mysql...

GSD-2023-1001540 powerpc/rtas: avoid scheduling in rtas_os_term()

powerpc/rtas: avoid scheduling in rtasosterm This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.337 by commit...

GSD-2023-1001251 ext4: fix use-after-free in ext4_orphan_cleanup

ext4: fix use-after-free in ext4orphancleanup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001239 ext4: fix error code return to user-space in ext4_get_branch()

ext4: fix error code return to user-space in ext4getbranch This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001228 usb: gadget: uvc: Prevent buffer overflow in setup handler

usb: gadget: uvc: Prevent buffer overflow in setup handler This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.85 by commit...

GSD-2023-1001073 usb: gadget: f_hid: fix f_hidg lifetime vs cdev

usb: gadget: fhid: fix fhidg lifetime vs cdev This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1001064 i2c: mux: reg: check return value after calling platform_get_resource()

i2c: mux: reg: check return value after calling platformgetresource This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1000962 orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()

orangefs: Fix kmemleak in orangefspreparedebugfshelpstring This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1000951 tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak

tpm: tpmtis: Add the missed acpiputtable to fix memory leak This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.87 by commit...