PT-2023-15940 · Unknown · Librespeed Speedtest

Name of the Vulnerable Software and Affected Versions: librespeed speedtest versions up to 5.2.4 Description: A vulnerability was found in an unknown functionality of the file results/stats.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely...

PT-2023-31144

Name of the Vulnerable Software and Affected Versions dpaste versions prior to v3.8 Description A security issue has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This can be exploited by an attacker to execute arbitrary JavaScript code in t...

CVE-2023-49620 Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for

Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized which almost used in sql task, with unauthorized access vulnerability IDOR, but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires...

PT-2023-30962

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions 3.0.0 through 3.0.1 Description The issue concerns the exposure of sensitive information to unauthorized actors, potentially including database credentials. This exposure can occur in Apache DolphinScheduler,...

PT-2023-30907 · Fastbots · Fastbots

Name of the Vulnerable Software and Affected Versions: fastbots versions prior to 0.1.5 Description: The issue allows an attacker to modify the locators.ini locator file with Python code that, without proper validation, is executed and could lead to remote code execution RCE. The vulnerability is...

PT-2023-8857

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.0.2110 Description The issue is related to the parsing of relative ex addresses in Vim, which can cause an overflow when a negative line number is used. This happens in the existing overflow check because the line numbe...

CVE-2023-47640 Insecure Use of HMAC-SHA1 For Session Signing in datahub

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

PT-2023-14019 · Intel · Intel Nuc Pro Software Suite

Name of the Vulnerable Software and Affected Versions: IntelR NUC Pro Software Suite versions prior to 2.0.0.9 Description: The issue is related to insecure inherited permissions in the installation software, which may allow an authenticated user to potentially enable escalation of privilege via...

OESA-2023-1802 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Out-of-bounds Read vulnerability in modmacro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. CVE-2023-31122 When a HTTP/2 stream was reset RST frame by a client, there was a...

PT-2023-35516 · Openssl +1 · Openssl +1

Name of the Vulnerable Software and Affected Versions: tor versions 0.4.7.14 through 0.4.8.7 tor version 0.4.8.8 Description: The issue is related to several bugs and reliability problems in the Tor software, including a crash during handshake with a remote relay when compiled with OpenSSL,...

PT-2023-29935 · Spicedb · Spicedb

Name of the Vulnerable Software and Affected Versions: SpiceDB versions prior to 1.27.0-rc1 Description: SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. When the provided datastore URI is malformed, such as having a...

Uncontrolled Resource Consumption ('Resource Exhaustion')

Overview rmagick is an an interface between Ruby and ImageMagick. Affected versions of this package are vulnerable to Uncontrolled Resource Consumption 'Resource Exhaustion' via the DrawOptionsinitialize function in rmdraw.c. An attacker can cause a denial of service by exhausting memory resource...

CVE-2023-5830

A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. This affects an unknown part of the file /api/authentication/login of the component WebTools. The manipulation of the argument Server leads to improper authentication. It is possible to initiate the attack...

Apple Mac OS X Security Updates (HT213983)

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-21969 · Zscaler · Zscaler Client Connector

Name of the Vulnerable Software and Affected Versions: Zscaler Client Connector for Linux versions prior to 1.3.1.6 Description: A buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows code injection. Recommendations: For versions prior to 1.3.1.6,...

PT-2023-29712

Name of the Vulnerable Software and Affected Versions Artifact Hub versions prior to 1.16.0 Description Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. A security researcher identified a bug in which by using...

PT-2023-26958 · Apache · Apache Traffic Server

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 9.0.0 through 9.2.2 Description: The issue is related to an Improper Input Validation vulnerability in Apache Traffic Server, specifically with malformed HTTP/2 frames. Users are recommended to upgrade to a fixe...

CVE-2023-45148 Rate limiter not working reliable when Memcached is installed in Nextcloud

Nextcloud is an open source home cloud server. When Memcached is used as memcache.distributed the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgra...

PT-2023-29000 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.1 stable Discourse versions prior to 3.2.0.beta2 Description: Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the "/polls/grouped poll...

PYSEC-2023-202

Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dagids and the stack-traces of import errors for those DAGs with import...