PT-2023-15050 · WordPress · Villatheme Cart All In One For Woocommerce

Name of the Vulnerable Software and Affected Versions: VillaTheme Cart All In One For WooCommerce plugin versions = 1.1.10 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which can lead to cart modification. Recommendations: For VillaTheme Cart All In One For WooCommerc...

Fail to install xenserver patch: The uploaded update file is invalid

Fail to install xenserver patch with error "The uploaded update file is invalid" xensource.log shows below trace. Oct 12 15:22:10 xxxxx xapi: warn||5521 HTTPS 192.168.23.251-:::80|poolupdate.introduce R:fc93dd2259e5|pervasiveext finally: Error while running cleanup after failure of main function:...

web2py development tool vulnerable to open redirect

Overview The admin development tool included in the web2py source code contains an open redirect vulnerability CWE-601. According to the developer, they do not recommend using the tool in operational environment or disclosing it on the Internet. Takuto Yoshikai of Aeye Security Lab reported this...

PT-2023-16563 · Unknown · Dash 7 Alliance Protocol

Name of the Vulnerable Software and Affected Versions: DASH 7 Alliance protocol versions prior to 0.5.0 Description: The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write. If the protocol has been compiled using default settings, th...

PT-2023-16739 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.3.3 Description: The issue is related to Cross-site Scripting XSS - Stored, which allows attackers to inject malicious scripts into the website. A patch is available and is anticipated to be part of...

PT-2023-14212 · WordPress · Forms By Captainform

Name of the Vulnerable Software and Affected Versions: Forms by CaptainForm – Form Builder for WordPress versions = 2.5.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-2012 · Hitachi · Hitachi Infrastructure Analytics Advisor +4

Name of the Vulnerable Software and Affected Versions: Hitachi Automation Director versions 8.2.0-00 through 10.6.1-00 Hitachi Infrastructure Analytics Advisor versions 2.0.0-00 through 4.0.0-00 Hitachi Ops Center Automator versions prior to 10.9.1-00 Hitachi Ops Center Analyzer versions prior to...

CVE-2023-23529

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this...

PT-2023-6830

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.2.1 SPIP versions 3.2.18 through 4.0.10 SPIP versions 4.1.8 through 4.2.1 SPIP version 3.2.11-3+deb11u7 Description SPIP is susceptible to a flaw related to the improper handling of untrusted data during memory...

PT-2023-16673 · Unknown · Rosariosis

Name of the Vulnerable Software and Affected Versions: rosariosis versions prior to 10.8.2 Description: The issue concerns exposure of sensitive information and improper access control in the GitHub repository francoisjacquet/rosariosis. Recommendations: For versions prior to 10.8.2, update to...

CVE-2023-25823 Gradio contains Use of Hard-coded Credentials

Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links i.e. creating a Gradio app and then setting share=True, a private SSH key is sent to any...

SUSE-SU-2023:0495-1 Security update for poppler

This update for poppler fixes the following issues: - CVE-2022-38784: Fixed integer overflow in the JBIG2 decoder bsc1202692...

SUSE-SU-2023:0490-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.38.5 boo1208328: - CVE-2023-23529: Fixed possible arbitrary code execution via maliciously crafted web content. Update to version 2.38.4 boo1207997: - CVE-2023-23517: Fixed web content processing that could have led to...

Samsung adds Message Guard protection against zero-click exploits

Samsung has announced the introduction of Message Guard for the Samsung Galaxy S23 series. It will be gradually rolled out to other Galaxy smartphones and tablets later this year. Message Guard works on images received in messages by the apps "Samsung Messages" and "Messages by Google" and...

PT-2023-16588 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.0 through 15.6.7 GitLab CE/EE versions 15.7 through 15.7.6 GitLab CE/EE versions 15.8 through 15.8.1 Description: An issue has been discovered in GitLab CE/EE that allows a Denial of Service DoS attack by uploading a...

PT-2023-19545 · Wpdevart · Wpdevart Organization Chart

Name of the Vulnerable Software and Affected Versions: WpDevArt Organization chart versions 1.4.4 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...

K92306170: BIG-IP AFM single endpoint flood/sweep DoS vector security exposure

Security Advisory Description BIG-IP AFM single endpoint sweep and single endpoint flood DoS vector configuration states are unexpectedly disabled after updating/upgrading software to BIG-IP 14.1.0 and later. This issue occurs when all of the following conditions are met: You updated/upgraded you...

K08503505: BIG-IP Edge Client for Windows vulnerability CVE-2021-23022

Security Advisory Description The BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and folder permissions. CVE-2021-23022 Impact This vulnerability can be exploited to allow an unprivileged user to run a specially crafted application to gain privilege escalation on th...

PT-2023-19689 · Dell · Dell Multifunction Printer E525W Driver/Software Suite

Name of the Vulnerable Software and Affected Versions: Dell Multifunction Printer E525w Driver and Software Suite versions prior to 1.047.2022, A05 Description: The issue is a local privilege escalation vulnerability that could be exploited by malicious users to compromise the affected system...

PT-2023-16225 · WordPress · Easy Affiliate Links

Name of the Vulnerable Software and Affected Versions: Easy Affiliate Links WordPress plugin versions prior to 3.7.1 Description: The issue arises from the plugin's failure to validate and escape some of its block options before outputting them back in a page or post where the block is embedded...