PT-2024-1277 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Confluence Data Center and Server versions 7.13.0 through 7.19.17 Confluence Data Center and Server versions 8.5.0 through 8.5.4 Confluence Data Center and Server versions 8.7.0 through 8.7.1 Description: The vulnerability is related to...

Request Smuggling org.apache.tomcat:tomcat-catalina Dependency in Crowd Data Center and Server

This High severity org.apache.tomcat:tomcat-catalina Dependency vulnerability was introduced in all versions of Crowd Data Center and Server before 5.0.10, 5.1.8 and 5.2.3. This org.apache.tomcat:tomcat-catalina Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2024-21642 D-Tale server-side request forgery through Web uploads

D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery SSRF, allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the Load From the Web input is turned off ...

CVE-2023-46740

Summary: CVE-2023-46740 affects CubeFS before v3.3.1, where an insecure random string generator used for user accessKeys could be predicted, enabling an attacker to impersonate users and obtain higher privileges. The root cause is the use of a weak RNG for sensitive per-user keys during user crea...

CVE-2023-46739 Timing attack can leak user passwords

CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS...

PT-2023-31693 · Unknown · Tms Booking For Appointments/Events Calendar – Amelia

Name of the Vulnerable Software and Affected Versions: TMS Booking for Appointments and Events Calendar – Amelia versions 1.0 through 1.0.85 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means...

PT-2023-31867 · Nautobot · Nautobot

Name of the Vulnerable Software and Affected Versions: Nautobot versions prior to 1.6.8 Nautobot versions prior to 2.1.0 Description: Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL...

PT-2023-31781 · Unknown · Nbviewer-App

Name of the Vulnerable Software and Affected Versions: nbviewer-app aka Jupyter Notebook Viewer versions prior to 0.1.6 Description: The issue is related to the get-task-allow entitlement for release builds, which can lead to code execution due to an improperly set entitlement. The developer has...

PYSEC-2023-266

Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation.As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the executio...

Mozilla Thunderbird Security Advisories (MFSA2023-53, MFSA2023-56) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

CVE-2023-37544 Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS

Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8., from 2.9.0 through 2.9., from 2.10.0 through 2.10.4, from 2.11.0 throug...

PT-2023-25607 · Unknown · Marketingfire Editorial Calendar

Name of the Vulnerable Software and Affected Versions: MarketingFire Editorial Calendar versions 3.7.12 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar. Recommendations: For versions 3.7.12 and...

CVE-2023-6932

A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread. We recommend upgrading past...

PT-2023-20268 · WordPress · Gamipress

Name of the Vulnerable Software and Affected Versions: GamiPress versions through 2.5.6 Description: The issue is related to a Missing Authorization vulnerability in the GamiPress plugin for WordPress, which is used for gamification purposes such as rewarding points, achievements, badges, and...

UBUNTU-CVE-2023-6817

A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The function nftpipapowalk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO Pile Packet Policies elements, leadi...

PT-2023-31067 · Unknown · Kulwant Nagi Affiliate Booster

Name of the Vulnerable Software and Affected Versions: Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates versions 3.0.5 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf ...

PT-2023-31711 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.182 Description: The issue is related to the mishandling of ACLs for audit logs in the app/Controller/AuditLogsController.php file. Recommendations: For versions prior to 2.4.182, update to version 2.4.182 or later ...

PT-2023-8085

Name of the Vulnerable Software and Affected Versions Flask-Security-Too versions =2.1.0 may impact applications that were previously not affected, as the autocorrect location header configuration was changed to False, making location headers in redirects relative by default. Recommendations For...

PT-2023-14653 · Unknown · Aleksandar Urošević Stock Ticker

Name of the Vulnerable Software and Affected Versions: Aleksandar Urošević Stock Ticker versions 3.23.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected cross-site scripting XSS. This means an attacker can...

PT-2023-31615 · Cube · Cube

Name of the Vulnerable Software and Affected Versions: Cube versions prior to 0.34.34 Description: The issue allows an attacker to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The problem has been patched in version 0.34.34. It is...