Important: Red Hat Enhancement Advisory: ACS 4.3 enhancement update

Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes new features and bug fixes. Release of ACS 4.3 provides these changes: New features: Increased support for hardware and software Vulnerability reporting 2.0 is generally available Watch and scan...

CVE-2023-39999

Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4...

XWiki 4.3-milestone-2 < 14.10.5 Privilege Escalation Vulnerability (GHSA-5mf8-v43w-mfxp)

XWiki is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescripti...

CVE-2020-36138

An issue was discovered in decodeframe in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service DoS...

HPESBGN04499 rev.2 - HPE Unified Correlation Analyzer, Multiple Vulnerabilities

Potential Security Impact: Local: Directory Traversal; Remote: Access Restriction Bypass, Authentication Bypass, Code Execution, Denial of Service DoS, Disclosure of Information, XML External Entity XXE, Input Validation SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified...

WordPress Nitek Carousel Slider Cool Transitions Plugin <= 4.3 is vulnerable to Cross Site Scripting (XSS)

Software Nitek Carousel Slider Cool Transitions Type Plugin Vulnerable versions = 4.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2a97bd96f108 Credits Rafie Muhamma...

XWiki 4.3-milestone-2 < 14.10.2 Code Injection Vulnerability (GHSA-4v38-964c-xjmw)

Xwiki is prone to a code injection vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

PT-2023-11562 · Ljcms · Ljcms

Name of the Vulnerable Software and Affected Versions: LJCMS version 4.3.R60321 Description: The issue allows a remote attacker to execute arbitrary code. This is achieved via the "ljcms/index.php" parameter. Recommendations: For version 4.3.R60321, consider restricting access to the...

CVE-2020-20735

File Upload vulnerability in LJCMS v.4.3.R60321 allows a remote attacker to execute arbitrary code via the ljcms/index.php parameter...

SUSE CVE-2013-4366

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification...

SUSE CVE-2013-4553

The XENDOMCTLgetmemlist hypercall in Xen 3.4.x through 4.3.x possibly 4.3.1 does not always obtain the pagealloclock and mmrwlock in the same order, which allows local guest administrators to cause a denial of service host deadlock...

SUSE CVE-2015-7850

ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service infinite loop or crash by pointing the key file at the log file...

PT-2023-14441 · Dentsply Sirona · Sidexis

Name of the Vulnerable Software and Affected Versions: Dentsply Sirona Sidexis versions prior to 4.3 Description: The issue is related to an unquoted service path, which can be exploited. Recommendations: For versions prior to 4.3, update to a version that contains a fix for this issue...

GSD-2023-1001064 i2c: mux: reg: check return value after calling platform_get_resource()

i2c: mux: reg: check return value after calling platformgetresource This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

CVE-2022-3254 AWP Classifieds Plugin < 4.3 - Unauthenticated SQLi

The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection...

SAP BusinessObjects Business Intelligence Platform 4.3 < 4.3 SP2 P5 Information Disclosure

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is prior to 4.3 SP2 P5 or 4.3 SP3. It is, therefore, affected by an information disclosure vulnerability. A remote attacker, authenticated as a CMS administrator can access the BOE Monitoring...

ManageEngine Access Manager Plus < 4.3 Build 4305 SQLi

The remote host is running a version of ManageEngine Access Manager Plus prior to 4.3 Build 4305. It is, therefore, affected by a SQL injection vulnerability. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the...

GSD-2022-1006039 i2c: Fix a potential use after free

i2c: Fix a potential use after free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.211 by commit 871a1e94929a27bf6e2cd99523865c840bbc2d87,...

Mercurial missing symlink check

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository...

Stormshield Network Security 代码问题漏洞

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from Stormshield France. A security vulnerability exists in Stormshield Network Security SNS version 4.3.x up to and including 4.3.8, which stems from an event log entry in the ASQ sofbus lacbus plugin that...