APSB23-36 : Security update available for Adobe Animate

Adobe has released an update for Adobe Animate. This update resolves a critical vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user...

Siemens Solid Edge

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

SUSE-SU-2023:2483-1 Security update for openldap2

This update for openldap2 fixes the following issues: - CVE-2023-2953: Fixed null pointer deref in bermemallocx bsc1211795...

GHSA-2JX2-QCM4-RF9H Incomplete Internal State Distinction in GRPCWebToHTTP2ServerCodec

Impact Affected gRPC Swift servers are vulnerable to precondition failures when parsing certain gRPC Web requests. This may lead to a denial of service. Patches The problem has been fixed in 1.2.0. Workarounds No workaround is available. Users must upgrade...

PT-2023-3350 · Fortinet · Fortiadcmanager +1

Name of the Vulnerable Software and Affected Versions: FortiADC Manager versions prior to 7.1.0 FortiADC versions 7.0.0 through 7.1.2 FortiADC version 7.2.0 Description: The issue is related to the improper neutralization of special elements used in an operating system command, which can be...

MGASA-2023-0193 Updated python-flask packages fix security vulnerability

Client 'session' cookie sent to other clients CVE-2023-30861...

Cisco Secure Workload Authenticated OpenAPI Privilege Escalation Vulnerability

A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper...

Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows Privilege Escalation Vulnerability

A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed aft...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 2100 Series Appliances SSL/TLS Denial of Service Vulnerability

A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause an affected device to relo...

HPESBUX04483 rev.1 - HP-UX BIND, Multiple Vulnerabilities

Potential Security Impact: Remote: Denial of Service DoS, Multiple Vulnerabilities, Unauthorized Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX BIND 9.11.1 prior to C.9.11.1.6.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-25215 |...

CVE-2023-32310 DataEase API interface has IDOR vulnerability

DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references IDOR. This could result in a user deleting another user's dashboard or messages or interfering with the...

Vulnerability fixed in Arista series 7000 switches

Arista has fixed a vulnerability in the EOS software of several Series 7000 switches. A malicious party can exploit abuse the vulnerability to use a manipulated DHCP packet to crash and restart the DHCP relay service to crash and restart, thus creating a partial Denial-of-Service can occur. Arist...

CVE-2023-33183 Error in calendar when booking an appointment reveals the full path of the website

Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server is unavailable. It is recommended that the Calendar app is updated to 3.5.5 or 4.2.3...

JVN#95981715: Starlette vulnerable to directory traversal

Starlette provided by Encode contains a directory traversal vulnerability CWE-22. Impact Under certain conditions, a remote attacker may view files in a web service which was built using the product. Solution Update the software Update the software according to the information provided by the...

PT-2023-19798 · Riot-Os · Riot-Os

Name of the Vulnerable Software and Affected Versions: RIOT-OS versions prior to 2023.04 Description: The issue affects the network stack of RIOT-OS, specifically in the processing of 6LoWPAN frames. An attacker can send a crafted frame, resulting in an integer underflow and out of bounds access ...

PT-2023-19887 · Unknown · 984.Ru For The Visually Impaired Plugin

Name of the Vulnerable Software and Affected Versions: 984.Ru For the visually impaired plugin versions = 0.58 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on ...

PT-2023-24104 · WordPress · Better Notifications For Wp

Name of the Vulnerable Software and Affected Versions: Made with Fuel Better Notifications for WP plugin versions 1.9.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-15181 · WordPress · Ninja Tables

Name of the Vulnerable Software and Affected Versions: Ninja Tables – Best Data Table Plugin for WordPress versions prior to 4.3.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-15184 · WordPress · Wp Basic Elements

Name of the Vulnerable Software and Affected Versions: WP Basic Elements plugin versions prior to 5.2.15 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...

PT-2023-14055 · Learningtimes · Badgeos

Name of the Vulnerable Software and Affected Versions: LearningTimes BadgeOS plugin versions = 3.7.1.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web applicatio...