CVE-2023-2013

CVE-2023-2013 affects GitLab CE/EE with versions starting from 1.2 up to 15.10.8, versions from 15.11 up to 15.11.7, and 16.0 up to 16.0.2. The issue arises from a discrepancy between the web application display and the Git CLI, which can be abused to social engineer victims into cloning non-trus...

Huawei EulerOS: Security Advisory for tpm2-tss (EulerOS-SA-2023-2114)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-2013

An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display a...

Huawei EulerOS: Security Advisory for tpm2-tss (EulerOS-SA-2023-2062)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 2.11.1 : tpm2-tss (EulerOS-SA-2023-2062)

According to the versions of the tpm2-tss package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - tpm2-tss is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Sta...

GHSA-RVRX-RRWH-R9P6 Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack

Impact An attacker who controls or compromises a registry can make the registry serve an infinite number of signatures for the artifact, causing a denial of service to the host machine running notation verify. Patches The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade the...

GHSA-9RP6-23GF-4C3H syncthing vulnerable to Cross-site Scripting (XSS) in Web GUI

Impact 1. A compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for...

PT-2023-24597 · Notation · Notation

Name of the Vulnerable Software and Affected Versions: notation versions prior to v1.0.0-rc.6 Description: The issue allows an attacker who has compromised a registry and added a high number of signatures to an artifact to cause denial of service of services on the machine, if a user runs the...

Gitpod vulnerable to Cross-site Scripting

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three vscode: vscode-insiders: jetbrains-gateway:...

PT-2023-24012 · Gitpod · Gitpod

Name of the Vulnerable Software and Affected Versions: Gitpod versions prior to 2022.11.3 Description: The issue allows for XSS because redirection can occur for some protocols outside of the trusted set of three, which includes vscode:, vscode-insiders:, and jetbrains-gateway:. Recommendations:...

PT-2023-4182 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 115.0.5790.170 Description: The issue is related to insufficient data validation in the Extensions component of Google Chrome, allowing an attacker to inject scripts or HTML into a privileged page via a crafted...

EulerOS Virtualization 2.9.1 : tpm2-tss (EulerOS-SA-2023-2008)

According to the versions of the tpm2-tss package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - tpm2-tss is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Sta...

EulerOS Virtualization 2.9.0 : tpm2-tss (EulerOS-SA-2023-2029)

According to the versions of the tpm2-tss package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - tpm2-tss is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Sta...

"Jiyu Kukan Toku-Toku coupon" App vulnerable to improper server certificate verification

Overview "Jiyu Kukan Toku-Toku coupon" App provided by RUNSYSTEM CO.,LTD. is vulnerable to improper server certificate verification CWE-295. Ryo Nihonyanagi of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

Widevine 输入验证错误漏洞

Widevine is a proprietary digital rights management DRM system from Widevine, Inc. An input validation error vulnerability exists in Widevine Trusted Application versions 5.0.0 through 5.1.1, which stems from the presence of an integer overflow issue that results in a buffer overflow...

CVE-2022-48479

The facial recognition TA of some products has the out-of-bounds memory read vulnerability. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service...

CVE-2022-48478

The facial recognition TA of some products lacks memory length verification. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service...

OESA-2023-1299 libtpms security update

A library providing TPM functionality for VMs. Targeted for integration into Qemu. Security Fixes: An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfull...

PT-2023-3691 · Zyxel · Zyxel Usg Flex Series +4

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2 Zyxel USG FLEX series firmware versions 4.60 through 5.36 Patch 2 Zyxel USG FLEX 50W series firmware versions 4.60 through 5.36 Patch 2 Zyxel USG20W-VPN series firmware versions 4.6...

PT-2023-4776 · Spring · Spring For Apache Kafka

Name of the Vulnerable Software and Affected Versions: Spring for Apache Kafka versions 3.0.9 and earlier Spring for Apache Kafka versions 2.9.10 and earlier Description: The issue is related to a deserialization attack vector in Spring for Apache Kafka. An attacker would have to construct a...