PT-2023-16265 · WordPress · File Away

Name of the Vulnerable Software and Affected Versions: File Away WordPress plugin versions 3.9.9.0.1 and earlier Description: The issue concerns a lack of validation and escaping of one of its shortcode attributes. This could allow users with a role as low as contributor to perform a Stored...

Important: kernel-livepatch-6.1.15-28.43

Issue Overview: In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. CVE-2022-48425 An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores an XFS image after failu...

Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs

Impact There are two separate security vulnerabilities here: 1 a security vulnerability that allows users to read arbitrary files on the machines that are running shared Gradio apps 2 the ability of users to use machines that are sharing Gradio apps to proxy arbitrary URLs Patches Both problems...

CVE-2023-34239 Unfiltered paths in gradio

Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. These issues have been addressed in...

Low: libcap

Issue Overview: libcap is vulnerable to a denial of service caused by the error handling in wrappthreadcreate function, which will cause memory to be leaked in the case of an error. CVE-2023-2602 Affected Packages: libcap Issue Correction: Run dnf update libcap --releasever 2023.0.20230607 or dnf...

PT-2023-12489 · WordPress · Wp Quick Frontend Editor

Name of the Vulnerable Software and Affected Versions: WP Quick FrontEnd Editor plugin for WordPress versions up to and including 5.5 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with minimal permissions to inject arbitra...

PT-2023-12477 · WordPress · Pwa For Wp & Amp

Name of the Vulnerable Software and Affected Versions: PWA for WP & AMP plugin for WordPress versions up to, and including, 1.7.32 Description: The issue is related to authorization bypass due to a missing capability check on the pwaforwp update features options function. This allows authenticate...

Medium: wayland

Issue Overview: An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wlshm buffer...

Medium: libldb

Issue Overview: Access controlled AD LDAP attributes can be discovered CVE-2023-0614 Affected Packages: libldb Issue Correction: Run dnf update libldb --releasever 2023.0.20230607 or dnf update --advisory ALAS2023-2023-187 --releasever 2023.0.20230607 to update your system. More information on ho...

Medium: dnsmasq

Issue Overview: An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. CVE-2023-28450 Affected Packages: dnsmasq Issue Correction: Run dnf update dnsmasq --releasever 2023.0.20230607 or dnf update...

PT-2023-22855 · Mobatime · Mobatime

Name of the Vulnerable Software and Affected Versions: Mobatime mobile application AMXGT100 versions 1.3.20 and earlier Description: The issue allows a low-privileged user to impersonate anyone else, including administrators, due to an Incorrect Authorization vulnerability in the Mobatime mobile...

PT-2023-3017

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 114.0.5735.110 Description The issue is related to a type confusion in V8, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code...

PT-2023-22995 · Teampass · Teampass

Name of the Vulnerable Software and Affected Versions: teampass versions prior to 3.0.9 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input that contains malicious scripts and later displays this input without proper validatio...

PT-2023-16789 · WordPress · Bookly

Name of the Vulnerable Software and Affected Versions: Bookly plugin for WordPress versions up to, and including, 21.5 Description: The issue is related to Stored Cross-Site Scripting via service titles due to insufficient input sanitization and output escaping. This allows authenticated attacker...

PT-2023-3037 · Honeywell · Honeywell Onewireless

Name of the Vulnerable Software and Affected Versions: Honeywell OneWireless version 322.1 Description: The issue is related to the use of insufficiently random values in Honeywell OneWireless, which may allow a remote attacker to manipulate claims in a client's JWT token, potentially gaining...

PT-2023-3619 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 114.0.5735.90 Description: The issue is related to an out of bounds memory access in Mojo, a component of Google Chrome, which could allow a remote attacker to exploit heap corruption via a crafted HTML page...

Debian: Security Advisory (DLA-3436-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-6984 · WordPress · Social Share

Name of the Vulnerable Software and Affected Versions: Social Share, Social Login and Social Comments WordPress plugin versions prior to 7.13.52 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being...

PT-2023-24282 · WordPress · Crm Perks Contact Form Entries

Name of the Vulnerable Software and Affected Versions: CRM Perks Contact Form Entries plugin versions prior to 1.3.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This type of vulnerability allows an...

PT-2023-21960 · Yoast · Yoast Seo

Name of the Vulnerable Software and Affected Versions: Yoast SEO: Local plugin versions prior to 14.9 Description: A Stored Cross-Site Scripting XSS vulnerability exists, allowing contributors or higher-privileged users to inject malicious scripts. Recommendations: For versions prior to 14.9,...