CVE-2023-35797 Apache Airflow Hive Provider Beeline RCE with Principal

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it...

PT-2023-24886 · Cometbft · Cometbft

Name of the Vulnerable Software and Affected Versions: CometBFT versions 0.34.28 through 0.34.28 CometBFT versions 0.37.1 through 0.37.1 Description: An internal modification to the way struct PeerState is serialized to JSON introduced a deadlock when the new function MarshallJSON is called. This...

PT-2023-23908 · Unknown · Pleasanter

Name of the Vulnerable Software and Affected Versions: Pleasanter versions 1.3.39.2 and earlier Description: A directory traversal issue allows a remote authenticated attacker to alter an arbitrary file on the server. Recommendations: For versions 1.3.39.2 and earlier, update to a version later...

PT-2023-21674 · Brave · Brave Browser

Name of the Vulnerable Software and Affected Versions: Brave Browser Android versions prior to 1.52.117 Description: An Open Redirect issue exists where the built-in QR scanner in Brave Browser Android navigated to scanned URLs automatically without showing the URL first. Now, the user must...

Apache Airflow JDBC Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s Connection URL parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission...

CVE-2023-20188

A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an authenticated, remote attacker to conduct a stored cross-site...

MGASA-2023-0205 Updated libcap packages fix security vulnerability

A vulnerability was found in the pthreadcreate function in libcap. This issue may allow a malicious actor to use cause realpthreadcreate to return an error, which can exhaust the process memory. CVE-2023-2602 A vulnerability was found in libcap. This issue occurs in the libcapstrdup function and...

PT-2023-23919 · Unknown · Snow Monkey Forms

Name of the Vulnerable Software and Affected Versions: Snow Monkey Forms versions v5.1.1 and earlier Description: The issue allows a remote unauthenticated attacker to delete arbitrary files on the server due to a directory traversal vulnerability. Recommendations: For Snow Monkey Forms versions...

SUSE-SU-2023:2647-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Add security patches bsc1211846: - CVE-2023-28204: Fixed processing of web content that may disclose sensitive information bsc1211659. - CVE-2023-32373: Fixed processing of maliciously crafted web content that may lead to arbitrary code...

PT-2023-19801 · WordPress · Responsive Css Editor

Name of the Vulnerable Software and Affected Versions: Responsive CSS EDITOR WordPress plugin version 1.0 Description: The issue arises from improper sanitization and escaping of a parameter before its use in a SQL statement, leading to a SQL injection. This can be exploited by high-privilege...

PT-2023-36201 · Go +1 · Go +1

Name of the Vulnerable Software and Affected Versions: kubernetes version 1.24 Description: The issue is related to a security release in the go 1.20 package, which is used by kubernetes. The package has been rebuilt with the go 1.20 security release to address the issue. Recommendations: For...

PT-2023-24755 · Unknown · Cloudexplorer Lite

Name of the Vulnerable Software and Affected Versions: cloudexplorer-lite versions prior to 1.2.0 Description: The issue concerns weak password requirements. Recommendations: For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue...

PT-2023-11497 · Unknown · Catfish Cms

Name of the Vulnerable Software and Affected Versions: CatfishCMS version 4.8.63 Description: A Cross Site Request Forgery CSRF issue was found that could allow attackers to gain administrator permissions. The issue is related to the "/index.php/admin/index/modifymanage.html" API endpoint...

PT-2023-24613 · Unknown · Jgraph/Drawio

Name of the Vulnerable Software and Affected Versions: jgraph/drawio versions prior to 18.1.3 Description: The issue is related to a Denial of Service in the GitHub repository jgraph/drawio. Recommendations: For versions prior to 18.1.3, update to version 18.1.3 or later to resolve the issue...

SUSE-SU-2023:2297-2 Security update for golang-github-vpenso-prometheus_slurm_exporter

This update of golang-github-vpenso-prometheusslurmexporter fixes the following issues: - rebuild the package with the go 1.19 security release bsc1200441 bsc1209658...

PT-2023-23807 · Dell · Dell Vxrail

Name of the Vulnerable Software and Affected Versions: Dell VxRail versions prior to 7.0.450 Description: The issue concerns an improper certificate validation, which could be exploited by a high privileged remote attacker to carry out a man-in-the-middle attack. This attack involves supplying a...

PT-2023-25514 · Webkul · Webkul Qloapps

Name of the Vulnerable Software and Affected Versions: Webkul QloApps version 1.6.0 Description: The issue is related to an unauthenticated Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to obtain a user's session cookie, which can then be used to impersonate the...

PT-2023-25323 · Safe · Fme Server +1

Name of the Vulnerable Software and Affected Versions: Safe Software FME Server versions prior to 2022.2.5 FME Flow versions prior to 2023.0 Description: A directory traversal issue allows an attacker to bypass validation when editing a network-based resource connection, resulting in unauthorized...

PT-2023-21602 · Unknown · Aakif Kadiwala Tags Cloud Manager

Name of the Vulnerable Software and Affected Versions: Aakif Kadiwala Tags Cloud Manager plugin versions 1.0.0 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

PT-2023-19225 · Unknown · Neil Gee Smoothscroller

Name of the Vulnerable Software and Affected Versions: Neil Gee Smoothscroller plugin versions prior to 1.0.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Neil Gee Smoothscroller plug...