SUSE-SU-2023:2287-1 Security update for cups-filters, poppler, texlive

This update for cups-filters, poppler, texlive fixes the following issues: cups-filters: - CVE-2023-24805: Fixed a remote code execution in the beh backend bsc1211340. texlive: - CVE-2023-32700: Fixed arbitrary code execution in LuaTeX bsc1211389. poppler: - Added missing header file...

PT-2023-15322 · WordPress · Viadat Creations Store Locator For Wordpress With Google Maps – Lotsoflocales

Name of the Vulnerable Software and Affected Versions: Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales plugin versions = 3.98.7 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintend...

PT-2023-14652 · WordPress · Glen Don L. Mongaya Drag/Drop Multiple File Upload – Contact Form 7

Name of the Vulnerable Software and Affected Versions: Glen Don L. Mongaya Drag and Drop Multiple File Upload – Contact Form 7 plugin versions = 1.3.6.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a...

PT-2023-17518

Name of the Vulnerable Software and Affected Versions Armoli Technology Cargo Tracking System versions before 3558f28 Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability, allowing authentication abuse and bypass. This vulnerability enables potenti...

PT-2023-20092 · Unknown · Csaba Kissi About Me 3000 Widget Plugin

Name of the Vulnerable Software and Affected Versions: Csaba Kissi About Me 3000 widget plugin versions = 2.2.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on...

PT-2023-21701 · Unknown · Snow Monkey Forms

Name of the Vulnerable Software and Affected Versions: Snow Monkey Forms versions v5.0.6 and earlier Description: A directory traversal vulnerability allows a remote unauthenticated attacker to obtain sensitive information, alter the website, or cause a denial-of-service DoS condition...

Tornado vulnerable to open redirect

Overview Tornado provided by tornadoweb contains a vulnerability that triggers open redirect CWE-601 under certain non-default configurations. Masashi Yamane of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

PT-2023-19124 · Bob Goetz · Wp-Topbar

Name of the Vulnerable Software and Affected Versions: Bob Goetz WP-TopBar plugin versions = 5.36 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-15434 · WordPress · Cs&M Hover Image Plugin

Name of the Vulnerable Software and Affected Versions: Julian Weinert // cs&m Hover Image plugin versions 1.4.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintende...

JVN#45127776: Tornado vulnerable to open redirect

Tornado provided by tornadoweb contains a vulnerability that triggers open redirect CWE-601 under certain non-default configurations. Impact When accessing a specially crafted URL, the user of the website using the affected product may be redirected to an arbitrary website. As a result, the user...

PT-2023-3599

Name of the Vulnerable Software and Affected Versions Requests versions 2.3.0 through 2.30.0 Description The issue is related to the leaking of Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This occurs due to how the rebuild proxies function is used to...

PT-2023-19575 · Unknown · Rbs Image Gallery

Name of the Vulnerable Software and Affected Versions: Rbs Image Gallery plugin versions 3.2.11 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Rbs Image Gallery plugin, specifically in the RoboSoft Photo Gallery, Images, Slider components. This issue can be exploited...

PT-2023-5815 · Apple · Macos Ventura +5

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.4 tvOS versions prior to 16.5 iOS versions prior to 16.5 iPadOS versions prior to 16.5 watchOS versions prior to 9.5 Description: A permissions issue was addressed with improved redaction of sensitive...

PT-2023-14433 · Acronis · Acronis Cyber Protect Home Office

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Home Office Windows versions before build 40208 Description: The issue is related to local privilege escalation due to the unrestricted loading of unsigned libraries. Recommendations: For Acronis Cyber Protect Home Offic...

PT-2023-17419 · Johnson Controls · Openblue Enterprise Manager Data Collector

Name of the Vulnerable Software and Affected Versions: OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 Description: The issue concerns improper authentication, allowing unauthorized access under certain circumstances. Recommendations: For versions prior to 3.2.5.75, update t...

PT-2023-21362 · Acronis · Acronis Cyber Infrastructure

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Infrastructure ACI versions prior to 5.3.1-38 Description: The issue is related to sensitive information disclosure due to improper authorization. Recommendations: For versions prior to 5.3.1-38, update to build 5.3.1-38 or late...

PT-2023-16438 · Wireshark +5 · Wireshark +5

Name of the Vulnerable Software and Affected Versions: Wireshark versions 4.0.5 and prior Description: The issue is due to a failure in validating the length provided by an attacker-crafted RTPS packet, making Wireshark susceptible to a heap-based buffer overflow, and possibly code execution in t...

Cisco Business Wireless Access Points Social Login Guest User Authentication Bypass Vulnerability

A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points APs could allow an unauthenticated, adjacent attacker to bypass social login authentication. This vulnerability is due to a logic error with the social login implementation. An...

SUSE-SU-2023:2233-1 Security update for cups-filters

This update for cups-filters fixes the following issues: - CVE-2023-24805: Fixed a remote code execution in the beh backend bsc1211340...

PT-2023-3357 · Abb · Abb Terra Ac Wallbox

Name of the Vulnerable Software and Affected Versions: ABB Terra AC wallbox UL40/80A versions 1.0;0 through 1.5.5 ABB Terra AC wallbox UL32A versions 1.0;0 through 1.6.5 ABB Terra AC wallbox CE Terra AC MID versions 1.0;0 through 1.6.5 ABB Terra AC wallbox CE Terra AC Juno CE versions 1.0;0 throu...