"Rikunabi NEXT" App for Android fails to restrict custom URL schemes properly

Overview "Rikunabi NEXT" App for Android provided by Recruit Co., Ltd. provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-939 which may be exploited to direct the App to access any sites. Nao Komatsu of LAC Co.,...

Medium: kernel

Issue Overview: An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfssetea in fs/ntfs3/xattr.c. CVE-2022-48502 A side channel vulnerability on some of the AMD CPUs may allow a...

PT-2023-19632 · Google · Google Chrome

Name of the Vulnerable Software and Affected Versions: Guardian/CMC versions prior to 22.6.2 Description: The issue arises under certain conditions, influenced by timing and the usage of the Chrome web browser, where the user session is not always fully invalidated upon logout. This allows an...

Important: openssh

Issue Overview: The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if the target user's ssh-agent is forwarded to an attacker-controlled system the code in /usr/lib is not necessarily safe for loading into...

PT-2023-26733 · Opnsense · Opnsense Community Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: The issue allows for XSS via the openAction in the app/controllers/OPNsense/Cron/ItemController.php file, specifically in the...

Medium: poppler

Issue Overview: Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder JBIG2Stream::readTextRegionSeg in JBIGStream.cc. Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the...

Medium: python-mako

Issue Overview: Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin. CVE-2022-40023 Affected Packages: python-mako Issue Correction: Run dnf update python-mako --releasever...

Zoom Client < 5.14.5 Buffer Overflow Vulnerability (ZSB-23028) - Linux

Zoom Client is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zoom:zoom"; ifdescriptio...

PT-2023-4632 · Adobe · Acrobat Document Cloud +3

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 23.003.20244 and earlier Adobe Acrobat Reader versions 20.005.30467 and earlier Adobe Acrobat 2020 Adobe Acrobat Reader 2020 Adobe Acrobat Document Cloud Adobe Acrobat Reader Document Cloud Description: The issue...

PT-2023-4635 · Adobe · Acrobat Document Cloud +2

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 23.003.20244 and earlier Adobe Acrobat Reader versions 20.005.30467 and earlier Adobe Acrobat 2020 Adobe Acrobat Document Cloud Description: The issue is related to a use-after-free vulnerability that could lead ...

PT-2023-4618 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 23.003.20244 and earlier Adobe Acrobat Reader versions 20.005.30467 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An...

PT-2023-4676 · Unknown · Mxsecurity

Name of the Vulnerable Software and Affected Versions: MXsecurity versions prior to v1.0.1 Description: The issue is related to the use of a hard-coded SSH host key in the MXsecurity platform, which may facilitate man-in-the-middle attacks and enable the decryption of SSH traffic. This could put...

PT-2023-4563 · Adobe · Acrobat Document Cloud +3

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 23.003.20244 and earlier Adobe Acrobat Reader versions 20.005.30467 and earlier Adobe Acrobat 2020 Adobe Acrobat Reader 2020 Adobe Acrobat Document Cloud Adobe Acrobat Reader Document Cloud Description: The issue...

PT-2023-26401

Name of the Vulnerable Software and Affected Versions Hiroaki Miyashita Custom Field Template plugin versions = 2.5.9 Description The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. Recommendations For versions = 2.5.9, update to a version higher than 2.5.9 to...

PT-2023-16394 · WordPress · Wp Food Manager

Name of the Vulnerable Software and Affected Versions: WP Food Manager versions prior to 1.0.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in multisite setup...

PT-2025-52970

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.2.0-rc8 Description The Linux kernel contained a locking issue within the interconnect component, specifically related to runpm runtime power management versus reclaim. The issue arose when icc bw set could be...

PT-2023-25682 · Wpfactory · Wpfactory Helper Plugin

Name of the Vulnerable Software and Affected Versions: WPFactory Helper plugin versions 1.5.2 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into a website, potentially leading to...

PT-2023-27873 · Answer +3 · Answer +2

Name of the Vulnerable Software and Affected Versions: answer versions prior to 1.1.0 Description: The issue concerns insufficient session expiration. Recommendations: For versions prior to 1.1.0, update to version 1.1.0 or later to resolve the issue...

PT-2023-24313 · Suprema · Suprema Biostar 2

Name of the Vulnerable Software and Affected Versions: Suprema BioStar 2 versions prior to 2.9.1 Description: A path traversal issue exists, allowing unauthenticated attackers to fetch arbitrary files from the server's web server. Recommendations: For Suprema BioStar 2 versions prior to 2.9.1,...

PT-2023-25635 · 3S Smart Software Solutions · Codesys Development System

Name of the Vulnerable Software and Affected Versions: CODESYS Development System versions 3.5.17.0 through 3.5.19.20 Description: A vulnerability in the CODESYS Development System allows for the execution of binaries from the current working directory in the user's context. Recommendations: For...