SUSE CVE-2023-4206

A use-after-free vulnerability in the Linux kernel's net/sched: clsroute component can be exploited to achieve local privilege escalation. When route4change is called on an existing filter, the whole tcfresult struct is always copied into the new instance of the filter. This causes a problem when...

Important: php8.2

Issue Overview: In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it ...

Important: python3.11

Issue Overview: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer...

Medium: poppler

Issue Overview: In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service application crashes with SIGABRT by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomple...

PT-2023-5597 · Tp Link · Archer A10 +2

Name of the Vulnerable Software and Affected Versions: Archer AX50 versions prior to Archer AX50JP V1 230529 Archer A10 versions prior to Archer A10JP V2 230504 Archer AX10 versions prior to Archer AX10JP V1.2 230508 Archer AX11000 versions prior to Archer AX11000JP V1 230523 Description: Multipl...

PT-2023-28181 · Jenkins · Jenkins Aws Codecommit Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier Description: The issue arises from a lack of permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue. This can be exploited...

PT-2023-11441 · Unknown · Searchblox

Name of the Vulnerable Software and Affected Versions: SearchBlox versions prior to 9.2.1 Description: The issue allows a lower user to access Admin functionality, resulting in Privileged Escalation. Recommendations: For versions prior to 9.2.1, update to version 9.2.1 or later to resolve the iss...

PT-2023-27389 · Carrot · Carrot

Name of the Vulnerable Software and Affected Versions: Carrrot plugin versions = 1.1.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the Carrrot plugin and can be exploited by an...

Important: amazon-ecr-credential-helper

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: amazon-ecr-credential-helper Note: This advisory is applicable to Amazon Linux 2 - Docker Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section for the...

WordPress Forminator Plugin < 1.24.4 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:incsub:forminator"; if description...

CVE-2023-39512

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...

CVE-2023-39515 Stored Cross-site Scripting on data_debug.php datasource path view in Cacti

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts an...

PT-2023-22928 · Unknown · Gamelauncher

Name of the Vulnerable Software and Affected Versions: GameLauncher versions prior to 4.2.59.5 Description: The issue allows local attackers to access data through a PendingIntent hijacking vulnerability. Recommendations: For versions prior to 4.2.59.5, update to version 4.2.59.5 or later to...

PT-2023-22926 · Gallery · Gallery

Name of the Vulnerable Software and Affected Versions: Gallery versions prior to 14.5.01.2 Description: The issue is related to improper authentication in the GallerySearchProvider of Gallery, allowing an attacker to access search history. Recommendations: For versions prior to 14.5.01.2, update ...

PT-2023-17690 · Salt +3 · Salt +3

Name of the Vulnerable Software and Affected Versions: Salt masters versions prior to 3005.2 Salt masters versions prior to 3006.2 Description: The issue concerns a denial-of-service DOS condition in minion return. When the request server receives several bad packets equal to the number of worker...

PT-2023-22930 · Unknown · Packageinstallerchn

Name of the Vulnerable Software and Affected Versions: PackageInstallerCHN versions prior to 13.1.03.00 Description: The issue allows a local attacker to access arbitrary files due to an intent redirection vulnerability. This vulnerability requires user interaction. Recommendations: For versions...

PT-2023-10313 · Aruba · Aruba Airwave

Name of the Vulnerable Software and Affected Versions: Aruba AirWave versions 7.7.14.1 and earlier Aruba AirWave versions 8.0.6 and earlier Description: The issue allows remote OS command execution and file disclosure by administrative users through VisualRF. Recommendations: For Aruba AirWave...

PT-2023-27198 · Vcita · Vcita Online Booking & Scheduling Calendar

Name of the Vulnerable Software and Affected Versions: vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita plugin versions = 4.3.2 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into...

PT-2023-26818 · Molongui · Molongui Author Box

Name of the Vulnerable Software and Affected Versions: Molongui Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui plugin versions = 4.6.19 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject...

PT-2023-25563 · WordPress · Jeffrey-Wp Media Library Categories

Name of the Vulnerable Software and Affected Versions: Jeffrey-WP Media Library Categories plugin versions = 2.0.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Jeffrey-WP Media Library Categories plugin. This vulnerability requires...