Medium: harfbuzz

Issue Overview: HarfBuzz 2.9.0 has an out-of-bounds write in hbbitsetinvertiblet::set called from hbsparsesett::set and hbsetcopy. CVE-2021-45931 Affected Packages: harfbuzz Issue Correction: Run dnf update harfbuzz --releasever 2023.0.20230322 or dnf update --advisory ALAS2023-2023-036...

Critical: nss

Issue Overview: NSS Network Security Services up to and including 3.73 is vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS 7, or PKCS 12 are likely to be impacted. Applications using...

Critical: apr

Issue Overview: An out-of-bounds array read in the aprtimeexp functions was fixed in the Apache Portable Runtime 1.6.3 release CVE-2017-12613. The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same...

Medium: curl

Issue Overview: A flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the same command line because the state would not be properly carried. This issue may result in limited confidentiality and integrity. CVE-2023-23914 A flaw was fou...

Low: libsolv

Issue Overview: A flaw was found in libsolv. A buffer overflow vulnerability could cause a denial of service. The highest threat from this vulnerability is to system availability. CVE-2021-3200 Affected Packages: libsolv Issue Correction: Run dnf update libsolv --releasever 2023.0.20230322 or dnf...

Important: emacs

Issue Overview: GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags " command suggest...

Important: device-mapper-multipath

Issue Overview: A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulat...

Medium: bind

Issue Overview: A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the forwarders may be cached and used by name if it needs to recurse for any reason. This issue causes it to obtain and pass on potentially incorrect answers. This flaw allows a...

PT-2023-17063 · Answerdev · Answer

Name of the Vulnerable Software and Affected Versions: answerdev/answer versions prior to 1.0.6 Description: The issue concerns Business Logic Errors in the GitHub repository answerdev/answer. There is no information provided about the estimated number of potentially affected devices worldwide or...

PT-2023-16580

Name of the Vulnerable Software and Affected Versions: WP Meta SEO WordPress plugin versions prior to 4.5.3 Description: The issue allows low-privilege users to make updates to certain data due to a lack of authorization for several ajax actions, leading to an arbitrary redirect. Recommendations:...

PT-2023-18223 · Samsung · Exynos

Name of the Vulnerable Software and Affected Versions: Exynos baseband versions prior to SMR Mar-2023 Release 1 Description: The issue is related to improper authorization implementation, which leads to incorrect handling of unencrypted messages. Recommendations: For versions prior to SMR Mar-202...

PT-2023-21238 · Opensips · Opensis

Name of the Vulnerable Software and Affected Versions: OpenSIPS versions prior to 3.1.7 and 3.2.4 Description: OpenSIPS is a Session Initiation Protocol SIP server implementation. Sending a malformed Via header to OpenSIPS triggers a segmentation fault when the function calc tag suffix is called....

PT-2023-15023 · Ibm · Ibm Robotic Process Automation

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation versions 21.0.0 through 21.0.7 IBM Robotic Process Automation version 23.0.0 Description: The issue concerns a client-side validation bypass for credential pools, which may result in the creation of invalid...

PT-2023-1824 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.7 and earlier Description: The issue is related to an out-of-bounds write vulnerability in Adobe Dimension, which could result in arbitrary code execution in the context of the current user. Exploitation of this...

PT-2023-2045 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.4-p2 and earlier Adobe Commerce versions 2.4.5-p1 and earlier Description: The issue is related to an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage...

PT-2023-15206 · Josh401 · Wp Csv To Database Plugin

Name of the Vulnerable Software and Affected Versions: josh401 WP CSV to Database plugin versions = 2.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

PT-2023-1803 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.7 and earlier Description: The issue is related to an Access of Uninitialized Pointer vulnerability. Exploitation of this issue could result in arbitrary code execution in the context of the current user. This...

PT-2023-1933 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.7 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...

PT-2023-1826 · Adobe · Substance3D - Stager

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Stager versions 2.0.0 and earlier Description: The issue is caused by a memory buffer overflow operation. Exploitation of this issue could allow an attacker to execute arbitrary code by using a specially crafted file. This...

PT-2023-15199 · Supsystic · Supsystic Slider

Name of the Vulnerable Software and Affected Versions: Supsystic Slider by Supsystic plugin versions = 1.8.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...