Advisory ROSA-SA-2023-2202

Software: python 3.6.8 OS: rosa-server79 packageevrstring: python-3.6.8-19.res7 CVE-ID: CVE-2023-24329 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A problem in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blacklisting methods by providing a URL that starts with empty...

Ubuntu: Security Advisory (USN-6240-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-4078 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.5 Description: A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue may allow an app to determine a user’s current location. The vulnerability is...

PT-2023-18458 · Unknown · Command Centre

Name of the Vulnerable Software and Affected Versions: Command Centre versions vEL8.80 prior to vEL8.80.1192 MR2 Description: A stack-based buffer overflow in the Command Centre Server allows an attacker to cause a denial of service attack via assigning cardholders to an Access Group...

PT-2023-4047

Name of the Vulnerable Software and Affected Versions macOS Monterey versions prior to 12.6.8 iOS versions prior to 15.7.8 iPadOS versions prior to 15.7.8 iOS versions prior to 16.6 iPadOS versions prior to 16.6 tvOS versions prior to 16.6 macOS Big Sur versions prior to 11.7.9 macOS Ventura...

CVE-2023-37901

Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges such as a speaker and then someone...

PT-2023-26087 · Unknown · Webboss.Io Cms

Name of the Vulnerable Software and Affected Versions: WebBoss.io CMS versions prior to 3.7.0.1 Description: A reflected cross-site scripting XSS issue was found in the software. This type of issue occurs when an application takes user input and sends it back to the user without proper validation...

Important: kernel

Issue Overview: A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAPNETADMIN capability to crash o...

Medium: python-requests

Issue Overview: A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how rebuildproxies is used to recompute and reattach the...

Medium: cups

Issue Overview: A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data immediately before the connection closed, resulting in a use-after-free in cupsdAcceptClient in...

PT-2023-26083 · Unknown · Tduck-Platform

Name of the Vulnerable Software and Affected Versions: tduck-platform version 4.0 Description: The issue allows attackers to execute arbitrary code via a crafted HTML file, exploiting an arbitrary file upload vulnerability. Recommendations: For tduck-platform version 4.0, update to a version that...

Low: python3.11

Issue Overview: No CVE associated with this advisory Affected Packages: python3.11 Issue Correction: Run dnf update python3.11 --releasever 2023.1.20230719 or dnf update --advisory ALAS2023-2023-252 --releasever 2023.1.20230719 to update your system. More information on how to update your system...

PT-2023-19551 · Unknown · Wesecur Security Plugin

Name of the Vulnerable Software and Affected Versions: WeSecur Security plugin versions 1.2.1 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For WeSecur Security plugin versions...

PT-2023-3912 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.33 and prior Description: The issue is related to errors in processing input data in the InnoDB component of the MySQL Server product of Oracle MySQL. Exploitation of this issue can allow a remote attacker to cause a...

PT-2023-25564 · Magepeople · Magepeople Team Event Manager/Tickets Selling Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin versions = 3.9.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated users with editor or higher...

Amazon Corretto Java 8.x < 8.382.05.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 8 8.382.05.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2023-Jul-18 advisory. - javafx/graphics CVE-2023-22043 - hotspot/compiler CVE-2023-22045 - core-libs/java.io CVE-2023-22049...

PT-2023-24297 · WordPress · Hijiri Custom Post Type Generator

Name of the Vulnerable Software and Affected Versions: Hijiri Custom Post Type Generator plugin versions = 2.4.2 Description: The issue is related to an Authenticated Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into the...

PT-2023-3705 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Reports Configuration component of Oracle Applications Technology in Oracle E-Business Suite. This can be...

PT-2023-20306 · WordPress · Inventorypress

Name of the Vulnerable Software and Affected Versions: InventoryPress WordPress plugin versions 1.7 and earlier Description: The issue allows users with the role of author and above to perform Stored Cross-Site Scripting attacks due to the plugin not sanitising and escaping some of its settings...

PT-2023-17320 · WordPress · Login Configurator

Name of the Vulnerable Software and Affected Versions: Login Configurator WordPress plugin versions through 2.1 Description: The issue is related to a reflected cross-site scripting vulnerability. It occurs because the plugin does not properly escape a URL parameter before outputting it to the...