The vulnerability of the nf_conntrack_dccp_packet() function in the net/netfilter/nf_conntrack_proto_dccp.c module of the Linux operating system allows a hacker to gain access to protected information.

The vulnerability of the nfconntrackdccppacket function in the net/netfilter/nfconntrackprotodccp.c module of the Linux kernel is related to the escape of allocated memory from the protected area. Exploiting this vulnerability can allow an attacker to gain access to protected information...

Oracle Linux 8 : webkit2gtk3 (ELSA-2023-7055)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7055 advisory. - Add patch for CVE-2023-28204 Resolves: 2209744 - Add patch for CVE-2023-32373 Resolves: 2209727 Tenable has extracted the preceding description block...

CVE-2023-43177

creationtimestamp| type| source ---|---|--- 2023-11-17 08:00:07+00:00| published-proof-of-concept| https://t.me/TopCyberTechNews/404 2023-11-18 06:12:36+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/9413 2023-12-12 09:30:14+00:00| published-proof-of-concept|...

Oracle Linux 9 : webkit2gtk3 (ELSA-2023-6535)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6535 advisory. 2.40.5-1 - Update to 2.40.5 Related: 2176270 2.40.4-1 - Update to 2.40.4 Related: 2176270 2.40.3-2 - Disable JIT Related: 2176270 2.40.3-1 - Update to...

The rsETH price can be manipulated easily when the deposit is low

Lines of code Vulnerability details Impact The rsETH price can be manipulated easily when the deposit is low, since the price is relies on the contracts' balance. Proof of Concept The rsETH's price is calculated by $\fractotalassetvaluetotalsupply$, and when supply is zero, the price will be 1...

The vulnerability of the Kanban function in the GLPI system for scheduling, incident management, and inventory tracking allows a malicious individual to gain unauthorized access to any user’s account.

The vulnerability of the Kanban function in systems for requests, incidents, and inventory management of computer equipment in GLPI is related to insecure privilege management. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to the account of any user...

webkitgtk: A website may able to track visited websites in private browsing

A flaw was found in webkitgtk where a website may be able to track the websites a user visited in private browsing mode...

webkitgtk: track sensitive user information

A flaw was found in WebKitGTK, which exists due to a logic issue in WebKit related to a user's privacy. A remote attacker may be able to track sensitive user information...

webkitgtk: Website may be able to track sensitive user information

A vulnerability was found in WebKitGTK. This security issue leads to tracking sensitive user information via a website...

CentOS 8 : webkit2gtk3 (CESA-2023:7055)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7055 advisory. - A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6...

RHEL 8 : webkit2gtk3 (RHSA-2023:7055)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7055 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: webkitgtk: arbitrary code execution...

CVE-2023-39197

An out-of-bounds read vulnerability was found in Netfilter Connection Tracking conntrack in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol...

X (Formerly Twitter): Cross-Domain Leakage of X Username / UserID due to Dynamically Generated JS File

The vulnerability allowed the retrieval of a user's X username and user ID from a dynamically generated JavaScript file hosted on Twitter. An attacker could force a victim to import the file from a malicious website, bypassing the Same-Origin Policy and exposing the user's sensitive information...

CVE-2023-5818

The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to missing or incorrect nonce validation on the amazonifyOptionsPage function. This makes it possible for unauthenticated attackers to update the plugins setting...

CVE-2023-5818

The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to missing or incorrect nonce validation on the amazonifyOptionsPage function. This makes it possible for unauthenticated attackers to update the plugins setting...

Cross site request forgery (csrf)

The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to missing or incorrect nonce validation on the amazonifyOptionsPage function. This makes it possible for unauthenticated attackers to update the plugins setting...

webkitgtk: Website may be able to track sensitive user information

A vulnerability was found in WebKitGTK. This security issue leads to tracking sensitive user information via a website...

webkitgtk: A website may able to track visited websites in private browsing

A flaw was found in webkitgtk where a website may be able to track the websites a user visited in private browsing mode...

RHEL 9 : webkit2gtk3 (RHSA-2023:6535)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6535 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: webkitgtk: arbitrary code execution...

Updated nss and firefox packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Queued up rendering could have allowed websites to clickjack. CVE-2023-5721 Address bar spoofing via bidirectional characters. CVE-2023-5732 Large WebGL draw could have led to a crash. CVE-2023-5724 WebExtensions could open arbitrary URLs...