Important: Red Hat Bug Fix Advisory: Red Hat Integration - Service Registry 2.4.4 SP1 OpenShift images

2.4.4 SP1 release of Red Hat Integration - Service Registry. This advisory makes available an update to the Red Hat Integration - Service Registry images...

SUSE-SU-2023:4109-1 Security update for erlang

This update for erlang fixes the following issues: - Updated to version 23.3.4.19 jscPED-6209: - CVE-2022-37026: Complete a previous insufficient fix for an authentication bypass bsc1205318...

PT-2023-23598 · Pegasystems · Pega Platform

Name of the Vulnerable Software and Affected Versions: Pega Platform versions 8.1 to 8.8.2 Description: The issue is an XSS problem related to Pin description. Recommendations: For Pega Platform versions 8.1 to 8.8.2, update to a version that includes a fix for the XSS issue. At the moment, there...

PT-2023-29334 · WordPress · Realmag777 Wolf – Wordpress Posts Bulk Editor/Manager Professional

Name of the Vulnerable Software and Affected Versions: realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin versions 1.0.7.1 and earlier Description: The issue is related to an Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability. This means that an attacker...

PT-2023-29346 · Castos · Castos Seriously Simple Stats Plugin

Name of the Vulnerable Software and Affected Versions: Castos Seriously Simple Stats plugin versions = 1.5.1 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

PT-2023-6294 · Oracle · Oracle Database Recovery Manager +2

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.20 Oracle Database Server versions 21.3 through 21.11 Description: The issue is related to insufficient input validation in the Oracle Database Recovery Manager component. This allows a...

PT-2023-29344 · WordPress · Arrow Plugins Social Feed | Custom Feed For Social Media Networks

Name of the Vulnerable Software and Affected Versions: Arrow Plugins Social Feed | Custom Feed for Social Media Networks plugin versions = 2.2.0 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. No information is provided about the estimated number of...

PT-2023-6273 · Oracle · Oracle Http Server

Name of the Vulnerable Software and Affected Versions: Oracle HTTP Server version 12.2.1.4.0 Description: The issue is related to a lack of protection for service data in the Web Listener component of Oracle HTTP Server. This allows an unauthenticated attacker with network access via HTTP to...

CVE-2023-45147 Arbitrary keys can be added to a topic's custom fields by any user in Discourse

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation...

PT-2023-29818 · Codedrafty · Codedrafty Mediabay – Media Library Folders

Name of the Vulnerable Software and Affected Versions: Codedrafty Mediabay – Media Library Folders plugin versions 1.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated users with editor or higher privileges. This...

PT-2023-30025 · WordPress · Enable Media Replace

Name of the Vulnerable Software and Affected Versions: Enable Media Replace WordPress plugin versions prior to 4.1.3 Description: The issue allows Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog, due to the unserialize of user input via the Remove...

PT-2023-32202 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac/gpac versions prior to 2.3.0-DEV. Description: The issue is related to a Denial of Service in the GitHub repository gpac/gpac. Recommendations: For versions prior to 2.3.0-DEV, update to version 2.3.0-DEV or later to resolve the issue...

PT-2023-29899 · WordPress · Booking Calendar

Name of the Vulnerable Software and Affected Versions: Booking Calendar WordPress plugin versions prior to 9.7.3.1 Description: The issue allows unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators due to the plugin's failure to sanitize and escape some of i...

PT-2023-25081 · Synology · Video Station

Name of the Vulnerable Software and Affected Versions: Video Station versions prior to 5.7.0 Description: A cross-site scripting XSS issue has been reported, potentially allowing authenticated users to inject malicious code via a network. Recommendations: For versions prior to 5.7.0, update to...

PT-2023-32184 · Vriteio · Vrite

Name of the Vulnerable Software and Affected Versions: vriteio/vrite versions prior to 0.3.0 Description: The issue is related to improper input validation in the GitHub repository vriteio/vrite. Recommendations: For versions prior to 0.3.0, update to version 0.3.0 or later to resolve the issue...

PT-2023-29052 · Dromara · Dromara Satoken

Name of the Vulnerable Software and Affected Versions: Dromara SaToken versions 1.3.50RC and earlier Description: An issue in Dromara SaToken when using Spring dynamic controllers may cause an authentication bypass due to a specially crafted request. Recommendations: For Dromara SaToken versions...

SUSE-SU-2023:4060-1 Security update for rage-encryption

This update for rage-encryption fixes the following issues: -CVE-2023-42811: chosen ciphertext attack possible against aes-gcm bsc1215657 update vendor.tar.zst to contain aes-gcm = 0.10.3 - Update to version 0.9.2+0: CI: Ensure apt repository is up-to-date before installing build deps CI: Build...

PT-2023-29387 · Supsystic · Contact Form By Supsystic

Name of the Vulnerable Software and Affected Versions: Supsystic Contact Form by Supsystic plugin versions = 1.7.27 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended action...

PT-2023-32143 · Unknown · Snipe/Snipe-It

Name of the Vulnerable Software and Affected Versions: snipe/snipe-it versions prior to 6.2.3 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository snipe/snipe-it. CSRF is a type of attack where an attacker tricks a user into performing unintended actions o...

PT-2025-14468 · Fortinet · Fortisiem

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSIEM versions 6.5.0 through 6.5.1, 6.6.0 through 6.6.3, 6.7.0 through 6.7.2, 7.0.0 Description: A relative path traversal issue allows an attacker to escalate privileges via uploading certain GUI elements. This issue can be...