Multiple vulnerabilities in PowerCMS

Overview PowerCMS provided by Alfasado Inc. contains multiple vulnerabilities listed below. Stored cross-site scripting vulnerability in the management screen CWE-79 - CVE-2023-49117 Open redirect vulnerability in the members' site CWE-601 - CVE-2023-50297 Alfasado Inc. reported these...

JVN#32646742: Multiple vulnerabilities in PowerCMS

PowerCMS provided by Alfasado Inc. contains multiple vulnerabilities listed below. Stored cross-site scripting vulnerability in the management screen CWE-79 - CVE-2023-49117 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 5.4 CVSS v2|...

HPESBMU04573 rev.1 - HPE Unified OSS Console, Multiple Vulnerabilities

Potential Security Impact: Remote: Access Restriction Bypass, Arbitrary Code Execution, Authentication Bypass, Compromise of System Integrity, Buffer Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC - Prior to v3.1.0 CVSS Scores: | CVE | CVSS...

KLA62539 DoS vulnerability in Google Chrome

Heap buffer overflow vulnerability was found in Google Chrome. Malicious users can exploit this vulnerability to cause denial of service. Original advisories Chrome Releases: Stable Channel Update for Desktop Exploitation Public exploits exist for this vulnerability. Related products Google-Chrom...

KLA62517 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, execute arbitrary code, spoof user interface, cause denial of service. Below is a complete list of vulnerabilities: 1. Security...

MGASA-2023-0350 Updated cjose packages fix a security vulnerability

The updated packages fix a security vulnerability: The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated...

PT-2023-32817 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow versions prior to 2.9.2 Description: The issue concerns a path traversal vulnerability. It involves the use of '..filename' in the GitHub repository mlflow/mlflow. Recommendations: For versions prior to 2.9.2, update to version 2.9.2 o...

PT-2023-7885

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 9.6 Description The issue is related to errors in key management in the ssh-agent tool of OpenSSH. It allows an attacker to disclose protected information by exploiting certain destination constraints that are not ful...

DLA-3690-1 intel-microcode - security update

Bulletin has no description...

SUSE CVE-2023-42883

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, tvOS 17.2, iOS 16.7.3 and iPadOS 16.7.3. Processing an image may lead to a denial-of-service...

SUSE-SU-2023:4828-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.42.3 bsc1217844: - Fix flickering while playing videos with DMA-BUF sink. - Fix color picker being triggered in the inspector when typing 'tan'. - Do not special case the 'sans' font family name. - Fix build failure with...

Open redirect in Apache Shiro

URL Redirection to Untrusted Site 'Open Redirect' vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+...

GHSA-HHW5-C326-822H Open redirect in Apache Shiro

URL Redirection to Untrusted Site 'Open Redirect' vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+...

DEBIAN-CVE-2023-46750

URL Redirection to Untrusted Site 'Open Redirect' vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+...

Stale copy of the public suffix list

We have identified that this project contains an out-of-date version of the Public Suffix List https://publicsuffix.org/. We are carrying out research to identify the potential impacts of using old versions of the Public Suffix List, and we intend to publish our results in academic conferences an...

PT-2023-33064 · Unknown · Gsemac.Common

Name of the Vulnerable Software and Affected Versions: Gsemac.Common affected versions not specified Description: The project contains an out-of-date version of the Public Suffix List. Using old versions of the Public Suffix List can lead to incorrect construction of privacy boundaries between...

SUSE-SU-2023:4697-1 Security update for gimp

This update for gimp fixes the following issues: - CVE-2023-44442: Fixed PSD File Parsing Heap-based bsc1217161. - CVE-2023-44444: Fixed PSP File Parsing Off-By-One bsc1217163...

PT-2023-30980 · Unknown · Car Rental Script

Name of the Vulnerable Software and Affected Versions: Car Rental Script version 3.0 Description: The issue concerns Multiple HTML Injection problems. These issues can be exploited via the SMS API Key or Default Country Code. Recommendations: For Car Rental Script version 3.0, update the software...

PT-2023-9842

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server version 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 Description A flaw in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware, is caused by insufficient input validation and a...

PT-2023-31124 · Peplink · Peplink Balance Two

Name of the Vulnerable Software and Affected Versions: Peplink Balance Two versions prior to 8.4.0 Description: A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication. This issue affects Peplink Balance Two and can be...