PT-2023-23316 · Brocade · Brocade Fabric Os

Name of the Vulnerable Software and Affected Versions: Brocade Fabric OS versions prior to 9.1.1c Brocade Fabric OS versions prior to 9.2.0 Description: The issue allows a local user to dump files under the user's home directory using the grep command. This is due to a vulnerability in the comman...

CVE-2023-38594

The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution...

VulnCheck KEV: CVE-2023-34478

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update to Apache Shiro 1.12.0+ or...

PT-2023-26542 · Unknown · Paddlepaddle

Name of the Vulnerable Software and Affected Versions: PaddlePaddle versions prior to 2.5.0 Description: The issue is related to a use after free condition in the paddle.diagonal function. This resulted in a potentially exploitable condition. Recommendations: For versions prior to 2.5.0, update t...

PT-2023-36235 · Conmon · Conmon

Name of the Vulnerable Software and Affected Versions: conmon versions prior to 2.1.7 Description: The issue concerns conmon, where several bugs have been fixed, including leaking symbolic links in the opt socket path directory, oom handling issues, and OOM watcher for cgroupv2 oom kill events. T...

PT-2023-4115 · B&R Industrial Automation · B&R Automation Runtime

Name of the Vulnerable Software and Affected Versions: B&R Automation Runtime versions prior to G4.93 Description: The issue is related to improper initialization implementation in the Portmapper service used in B&R Industrial Automation Automation Runtime. This allows unauthenticated network-bas...

PT-2023-26546 · Unknown · Paddlepaddle

Name of the Vulnerable Software and Affected Versions: PaddlePaddle versions prior to 2.5.0 Description: The issue allows for command injection in the fs.py module, resulting in the ability to execute arbitrary commands on the operating system. Recommendations: For versions prior to 2.5.0, update...

PT-2023-24694 · Jenkins · Jenkins Plug-In For Servicenow Devops +1

Name of the Vulnerable Software and Affected Versions: Jenkins Plug-in for ServiceNow DevOps versions prior to 1.38.1 Description: A cross-site request forgery issue exists that could cause the unwanted exposure of sensitive information if exploited successfully. Recommendations: For versions pri...

GHSA-M8FW-P3CR-6JQC Cross-Site Scripting in CKEditor4 WordCount Plugin

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C 4.4 Problem The WordCount plugin npm:ckeditor-wordcount-plugin for CKEditor4 is vulnerable to cross-site scripting when switching to the source code mode. This plugin is enabled via the Full.yaml configuration present, but is not...

PT-2023-25861 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.9 Description: DataEase is an open source data visualization analysis tool. It has a SQL injection vulnerability that can bypass blacklists. Recommendations: For versions prior to 1.18.9, update to version 1.18...

PT-2023-25566 · WordPress · Wpxpo Postx – Gutenberg Post Grid Blocks

Name of the Vulnerable Software and Affected Versions: wpxpo PostX – Gutenberg Post Grid Blocks plugin versions = 2.9.9 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into ...

thunderbird security update

102.13.0-2.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build 102.13.0-2 - Update to 102.13.0 build2 102.13.0-1 - Update to 102.13.0 build1...

SUSE-SU-2023:2917-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: grafana: - Update to version 9.5.5: CVE-2023-3128: Fix authentication bypass using Azure AD OAuth bsc1212641, jscPED-3694 Bug fixes: Auth: Show invite button if disable login form is set to false. Azure: Fix Kusto auto-completion for Azure datasources. RBAC...

PT-2023-7418

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.9.0 Description The issue arises from improper validation, allowing an attacker to modify the HTTP request or create a new one if they control the HTTP version. This can lead to CRLF injection and Request Smuggling...

PT-2023-24122 · Hashicorp +1 · Hashicorp Nomad Enterprise +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad Enterprise versions 1.2.11 through 1.5.6 HashiCorp Nomad Enterprise version 1.4.10 Description: A vulnerability exists where the API caller's ACL token secret ID is exposed to Sentinel policies. Additionally, ACL policies usin...

PT-2023-26163 · Pluginpress · Pluginpress Shortcode Imdb

Name of the Vulnerable Software and Affected Versions: PluginPress Shortcode IMDB plugin versions 6.0.8 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended action...

PT-2023-15082 · Sitealert · Sitealert

Name of the Vulnerable Software and Affected Versions: SiteAlert plugin versions = 1.9.7 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that...

PT-2023-21484 · Ibm · Bigfix Webui Api App

Name of the Vulnerable Software and Affected Versions: Bigfix WebUI API App versions prior to 14 Description: The issue is related to insufficient validation, allowing an authenticated WebUI user to issue SQL queries via an unparameterized SQL query. Recommendations: For versions prior to 14,...

PT-2023-24105 · WordPress · Crudlab Jazz Popups

Name of the Vulnerable Software and Affected Versions: CRUDLab Jazz Popups plugin versions 1.8.7 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-19157 · WordPress · Premmerce

Name of the Vulnerable Software and Affected Versions: Premmerce plugin versions = 1.3.17 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application tha...