WordPress Awesome Support Plugin <= 6.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Awesome Support Type Plugin Vulnerable versions = 6.1.4 Fixed in 6.1.5 OWASP Top 10 A2: Broken Authentication Classification Cross Site Request Forgery CSRF CVE CVE-2023-48323 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID afdaccd9618c Credits thiennv Required...

The vulnerabilities of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are related to the execution of operations beyond the buffer boundaries in memory. This allows attackers to execute arbitrary code or trigger service failures.

The vulnerability of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure...

Woocommerce Support System <= 1.2.1 - Authenticated (Administrator+) SQL Injection via 'orderby'

Description The Woocommerce Support System plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

CVE-2023-49210

The openssl aka node-openssl NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field used for command execution. NOTE: This vulnerability only affects products that are no longer supported by t...

WordPress Awesome Support Plugin <= 6.1.4 is vulnerable to Broken Access Control

Software Awesome Support Type Plugin Vulnerable versions = 6.1.4 Fixed in 6.1.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-48324 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 3ccfaf9111b5 Credits thiennv Required privilege...

CVE-2023-41146

Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account...

Design/Logic Flaw

Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account...

CVE-2023-41146

Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account...

CVE-2023-41146

CVE-2023-41146 affects Autodesk Customer Support Portal. The vulnerability is a design/logic flaw in access control where cases created by one user on a given account can be viewed by other users on the same account. Documented impact is exposure of potentially sensitive case information without ...

PT-2023-27822 · Autodesk · Autodesk Customer Support Portal

Name of the Vulnerable Software and Affected Versions: Autodesk Customer Support Portal affected versions not specified Description: The issue allows cases created by users under an account to be visible to other users on the same account, potentially exposing sensitive information...

USN-6500-1 squid vulnerabilities

Joshua Rogers discovered that Squid incorrectly handled validating certain SSL certificates. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. CVE-2023-46724 Joshua...

USN-6493-2 hibagent update

USN-6493-1 fixed a vulnerability in hibagent. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: On Ubuntu 18.04 LTS and Ubuntu 16.04 LTS, the hibagent package has been updated to add IMDSv2 support, as IMDSv1 uses an insecure...

Users can make external storage mount points inaccessible for other users

None...

user_ldap app logs user passwords in the log file on level debug

None...

Server-Side Request Forgery (SSRF) in Mail app

None...

Admins can change authentication details of user configured external storage

None...

PT-2023-36322 · Canonical · Hibagent

Name of the Vulnerable Software and Affected Versions: hibagent versions prior to the updated version for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS Description: The issue concerns the use of an insecure protocol by IMDSv1, which is no longer recommended. To address this, the hibagent package has been...

SUSE: Security Advisory (SUSE-SU-2023:4480-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mozilla Firefox Security Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 120, Firefox ESR versions prior to 115.5, and Thunderbird versions prior to 115.5.0, which stems from the use of the Selection API...

This Week in Spring - Spring Boot 3.2 edition - November 21st, 2023

Hi, Spring fans! Welcome to another epic installment of This Week in Spring! As amazing as the week's already been, it's all leading up to this Thursday - Thanksgiving day! - when we release Spring Boot 3.2! and yes, I am very grateful. This release is stuffed to the gills with a ton of new...