CVE-2022-24834 Heap overflow issue with the Lua cjson library used by Redis

Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support,...

GHSA-4Q2Q-Q5PW-2342 Apache Airflow Apache Hive Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxyuser option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updatin...

PT-2023-26024 · Elecom +1 · Elecom Wrc-1167Febk-A +8

Name of the Vulnerable Software and Affected Versions: ELECOM WRC-1167GHBK3-A versions 1.24 and earlier ELECOM WRC-1167FEBK-A versions 1.18 and earlier ELECOM WRC-F1167ACF2 all versions ELECOM WRC-600GHBK-A all versions ELECOM WRC-733FEBK2-A all versions ELECOM WRC-1467GHBK-A all versions ELECOM...

PT-2023-26278 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2023.05.1 Description: The issue allows for reflected XSS via the Referer header during artifact downloads. Recommendations: For versions prior to 2023.05.1, update to version 2023.05.1 or later to resolve...

PT-2023-24448 · WordPress · About Me 3000

Name of the Vulnerable Software and Affected Versions: About Me 3000 widget plugin for WordPress versions up to, and including, 2.2.6 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows...

PT-2023-4148 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 19.3R3-S10 Juniper Networks Junos OS versions 20.1 prior to 20.1R3-S4 Juniper Networks Junos OS versions 20.2 prior to 20.2R3-S6 Juniper Networks Junos OS versions 20.3 prior to 20.3R3-S6 Juniper...

PT-2023-3990 · Sonicwall · Sonicwall Gms +1

Name of the Vulnerable Software and Affected Versions: SonicWall GMS versions 9.3.2-SP1 and earlier SonicWall Analytics versions 2.5.0.4-R7 and earlier Description: The issue is related to an authentication bypass vulnerability in the SonicWall Analytics and SonicWall Global Management System GMS...

PT-2023-3800 · Sonicwall · Sonicwall Gms +1

Name of the Vulnerable Software and Affected Versions: SonicWall GMS versions 9.3.2-SP1 and earlier SonicWall Analytics versions 2.5.0.4-R7 and earlier Description: The issue is related to a Path Traversal vulnerability that allows a remote authenticated attacker to read arbitrary files from the...

PT-2023-12522 · WordPress · Qtranslate Slug

Name of the Vulnerable Software and Affected Versions: Qtranslate Slug plugin for WordPress versions up to and including 1.1.18 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save postdata function. This allows unauthenticated...

PT-2023-20086 · Unknown · Reservation.Studio

Name of the Vulnerable Software and Affected Versions: Reservation.Studio Reservation.Studio widget plugin versions 1.0.11 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Reservation.Studio Reservation.Studio widget plugin. This issue allows for malicious requests to ...

PT-2023-19346 · Unknown · Dave Jesch Database Collation Fix

Name of the Vulnerable Software and Affected Versions: Dave Jesch Database Collation Fix plugin versions 1.2.7 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-25378 · Unknown · Oopspam Anti-Spam

Name of the Vulnerable Software and Affected Versions: OOPSpam OOPSpam Anti-Spam plugin versions = 1.1.44 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...

PT-2023-17442 · Yontem Informatics · Yontem Informatics Vehicle Tracking System

Name of the Vulnerable Software and Affected Versions: Yontem Informatics Vehicle Tracking System versions prior to 8 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attack...

DLA-3485-1 php-cas - security update

Bulletin has no description...

MGASA-2023-0216 Updated apache-ivy packages fix security vulnerability

Improper path allowed when extracting archive.CVE-2022-37865 Possible path traversal in download path CVE-2022-37866...

PT-2023-25757 · Unknown · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.17 Description: The issue allows for Remote Command Execution via the File Upload Function. Recommendations: For CMS Made Simple version 2.2.17, update to a version that fixes this issue...

PT-2023-22874 · Samsung · Samsung Pass

Name of the Vulnerable Software and Affected Versions: Samsung Pass versions prior to 4.2.03.1 Description: The issue is related to improper access control in Samsung Pass, allowing physical attackers to access Samsung Pass data on an unlocked device under certain conditions. Recommendations: For...

PT-2023-22870 · Samsung · Smart Switch Pc

Name of the Vulnerable Software and Affected Versions: Smart Switch PC versions prior to 4.3.23052 1 Description: The issue is related to improper validation of integrity checks, allowing local attackers to delete arbitrary directories using directory junctions. Recommendations: For versions prio...

Cisco Duo Authentication Proxy Information Disclosure Vulnerability

A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability exists because certain unencrypted credentials are stored. An attacker could exploit this...

Cisco BroadWorks Privilege Escalation Vulnerability

A vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected device. The vulnerability is due to insufficient input validation by the operating system CLI. An attacker could exploit this vulnerability by issuing a crafted...