SUSE-SU-2023:4109-1 Security update for erlang

This update for erlang fixes the following issues: - Updated to version 23.3.4.19 jscPED-6209: - CVE-2022-37026: Complete a previous insufficient fix for an authentication bypass bsc1205318...

PT-2023-20094 · Ezoic · Ezoic Ampedsense – Adsense Split Tester

Name of the Vulnerable Software and Affected Versions: Ezoic AmpedSense – AdSense Split Tester plugin versions = 4.68 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowin...

CVE-2023-41752 Apache Traffic Server: s3_auth plugin problem with hash calculation

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue...

PT-2023-6344 · Oracle · Oracle Outside In Technology

Name of the Vulnerable Software and Affected Versions: Oracle Outside In Technology versions 8.5.6 Description: The issue exists due to insufficient input validation in the Content Access SDK, Image Export SDK, PDF Export SDK, and HTML Export SDK components of Oracle Outside In Technology. This...

PT-2023-6382 · Oracle · Oracle Analytics Bi Publisher

Name of the Vulnerable Software and Affected Versions: Oracle Analytics BI Publisher versions 6.4.0.0.0 through 7.0.0.0.0 Description: The issue is related to insufficient input validation in the Web Server component of Oracle BI Publisher. This allows a low-privileged attacker with network acces...

PT-2023-28380 · Unknown · Onsinview2

Name of the Vulnerable Software and Affected Versions: OnSinView2 versions 2.0.1 and earlier Description: An issue with improper restriction of operations within the bounds of a memory buffer exists. If exploited, this could lead to information disclosure or the execution of arbitrary code by...

PT-2023-6300 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.20 Oracle Database Server versions 21.3 through 21.11 Description: The issue is related to insufficient input validation in the Oracle Notification Server component of Oracle Database Server. Th...

GHSA-FPCF-QR79-HJQP SQL Injection in Apache InLong

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false records, making it harder to audit and trace malicious activities. Users are...

web2py vulnerable to OS command injection

Overview web2py web application framework contains an OS command injection vulnerability CWE-78. Masashi Yamane of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact When web2py is configured to u...

PT-2023-6415 · D Link · D-Link Di-7003Gv2 +4

Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 versions 23.08.25D1 and before D-Link DI-7100G+V2 versions 23.08.23D1 and before D-Link DI-7100GV2 version 23.08.23D1 D-Link DI-7200G+V2 versions 23.08.23D1 and before D-Link DI-7200GV2 versions 23.08.23E1 and before D-Link...

PT-2023-29836 · WordPress · Mahlamusa Who Hit The Page – Hit Counter

Name of the Vulnerable Software and Affected Versions: Mahlamusa Who Hit The Page – Hit Counter plugin versions = 1.4.14.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application tha...

PT-2023-29624 · Mailmunch · Constant Contact Forms By Mailmunch

Name of the Vulnerable Software and Affected Versions: MailMunch Constant Contact Forms by MailMunch plugin versions = 2.0.10 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-29619 · Unknown · Hassan Ali Snap Pixel Plugin

Name of the Vulnerable Software and Affected Versions: Hassan Ali Snap Pixel plugin versions = 1.5.7 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-6176 · D Link · Di-7300G +6

Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 versions 23.08.25D1 and earlier D-Link DI-7100G versions 23.08.23D1 and earlier D-Link DI-7100GV2 version 23.08.23D1 D-Link DI-7200G versions 23.08.23D1 and earlier D-Link DI-7200GV2 versions 23.08.23E1 and earlier D-Link...

PT-2023-29630 · Pixelgrade · Pixfields

Name of the Vulnerable Software and Affected Versions: PixelGrade PixFields plugin versions prior to 0.7.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a we...

JVN#80476432: web2py vulnerable to OS command injection

web2py web application framework contains an OS command injection vulnerability CWE-78. Impact When web2py is configured to use notifySendHandler for logging not the default configuration, a crafted web request may execute an arbitrary OS command on the web server using the product. Solution Upda...

PT-2023-29477 · Unknown · Matt Mckenny Stout Google Calendar Plugin

Name of the Vulnerable Software and Affected Versions: Matt McKenny Stout Google Calendar plugin versions = 1.2.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the use...

PT-2023-29586 · Unknown · Christopher Finke Feed Statistics

Name of the Vulnerable Software and Affected Versions: Christopher Finke Feed Statistics plugin versions = 4.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...

PT-2023-28686 · Dell · Dell Openmanage Server Administrator

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Server Administrator versions 11.0.0.0 and prior Description: The issue is related to an Improper Access Control vulnerability. A local low-privileged malicious user could potentially exploit this vulnerability to execute...

PT-2023-29366 · Unknown · Leadsquared Suite

Name of the Vulnerable Software and Affected Versions: LeadSquared Suite plugin versions = 0.7.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web application that...