PT-2023-20678 · Vega · Vega

Name of the Vulnerable Software and Affected Versions: Vega versions prior to 5.23.0 Description: The lassoAppend function in Vega accepts 3 arguments and internally invokes the push function on the 1st argument, specifying an array consisting of the 2nd and 3rd arguments as the push call argumen...

Cisco Webex App for Web Cross-Site Scripting Vulnerability

A vulnerability in the file upload functionality of Cisco Webex App for Web could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input. An attacker could...

PT-2023-20455 · Xwiki · Xwiki Commons

Name of the Vulnerable Software and Affected Versions: XWiki Commons versions 3.1-milestone-1 through 13.10.8 XWiki Commons versions 14.0.0 through 14.4.3 XWiki Commons versions 14.5.0 through 14.7RC0 Description: The issue allows any user to edit their own profile and inject code, which is...

PT-2023-15050 · WordPress · Villatheme Cart All In One For Woocommerce

Name of the Vulnerable Software and Affected Versions: VillaTheme Cart All In One For WooCommerce plugin versions = 1.1.10 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which can lead to cart modification. Recommendations: For VillaTheme Cart All In One For WooCommerc...

Fail to install xenserver patch: The uploaded update file is invalid

Fail to install xenserver patch with error "The uploaded update file is invalid" xensource.log shows below trace. Oct 12 15:22:10 xxxxx xapi: warn||5521 HTTPS 192.168.23.251-:::80|poolupdate.introduce R:fc93dd2259e5|pervasiveext finally: Error while running cleanup after failure of main function:...

web2py development tool vulnerable to open redirect

Overview The admin development tool included in the web2py source code contains an open redirect vulnerability CWE-601. According to the developer, they do not recommend using the tool in operational environment or disclosing it on the Internet. Takuto Yoshikai of Aeye Security Lab reported this...

PT-2023-16739 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.3.3 Description: The issue is related to Cross-site Scripting XSS - Stored, which allows attackers to inject malicious scripts into the website. A patch is available and is anticipated to be part of...

PT-2023-16563 · Unknown · Dash 7 Alliance Protocol

Name of the Vulnerable Software and Affected Versions: DASH 7 Alliance protocol versions prior to 0.5.0 Description: The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write. If the protocol has been compiled using default settings, th...

PT-2023-14212 · WordPress · Forms By Captainform

Name of the Vulnerable Software and Affected Versions: Forms by CaptainForm – Form Builder for WordPress versions = 2.5.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-2012 · Hitachi · Hitachi Infrastructure Analytics Advisor +4

Name of the Vulnerable Software and Affected Versions: Hitachi Automation Director versions 8.2.0-00 through 10.6.1-00 Hitachi Infrastructure Analytics Advisor versions 2.0.0-00 through 4.0.0-00 Hitachi Ops Center Automator versions prior to 10.9.1-00 Hitachi Ops Center Analyzer versions prior to...

CVE-2023-23529

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this...

PT-2023-6830

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.2.1 SPIP versions 3.2.18 through 4.0.10 SPIP versions 4.1.8 through 4.2.1 SPIP version 3.2.11-3+deb11u7 Description SPIP is susceptible to a flaw related to the improper handling of untrusted data during memory...

PT-2023-16673 · Unknown · Rosariosis

Name of the Vulnerable Software and Affected Versions: rosariosis versions prior to 10.8.2 Description: The issue concerns exposure of sensitive information and improper access control in the GitHub repository francoisjacquet/rosariosis. Recommendations: For versions prior to 10.8.2, update to...

CVE-2023-25823 Gradio contains Use of Hard-coded Credentials

Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links i.e. creating a Gradio app and then setting share=True, a private SSH key is sent to any...

SUSE-SU-2023:0495-1 Security update for poppler

This update for poppler fixes the following issues: - CVE-2022-38784: Fixed integer overflow in the JBIG2 decoder bsc1202692...

SUSE-SU-2023:0490-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.38.5 boo1208328: - CVE-2023-23529: Fixed possible arbitrary code execution via maliciously crafted web content. Update to version 2.38.4 boo1207997: - CVE-2023-23517: Fixed web content processing that could have led to...

Samsung adds Message Guard protection against zero-click exploits

Samsung has announced the introduction of Message Guard for the Samsung Galaxy S23 series. It will be gradually rolled out to other Galaxy smartphones and tablets later this year. Message Guard works on images received in messages by the apps "Samsung Messages" and "Messages by Google" and...

PT-2023-16588 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.0 through 15.6.7 GitLab CE/EE versions 15.7 through 15.7.6 GitLab CE/EE versions 15.8 through 15.8.1 Description: An issue has been discovered in GitLab CE/EE that allows a Denial of Service DoS attack by uploading a...

PT-2023-19545 · Wpdevart · Wpdevart Organization Chart

Name of the Vulnerable Software and Affected Versions: WpDevArt Organization chart versions 1.4.4 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...

K92306170: BIG-IP AFM single endpoint flood/sweep DoS vector security exposure

Security Advisory Description BIG-IP AFM single endpoint sweep and single endpoint flood DoS vector configuration states are unexpectedly disabled after updating/upgrading software to BIG-IP 14.1.0 and later. This issue occurs when all of the following conditions are met: You updated/upgraded you...