SUSE-SU-2023:2312-1 Security update for go1.18-openssl

This update for go1.18-openssl fixes the following issues: - Add subpackage go1.x-libstd compiled shared object libstd.so jscPED-1962 Main go1.x package included libstd.so in previous versions Split libstd.so into subpackage that can be installed standalone Continues the slimming down of main go1...

PT-2023-36185 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security release in Go 1.19. The terraform-provider-helm package has been rebuilt with this security release to address the issue. Recommendations:...

PT-2023-14033 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.8 MediaWiki versions 1.36.x through 1.37.4 MediaWiki versions 1.38.x through 1.38.2 Description: An issue was discovered in MediaWiki where the alreadyrolled message can leak a user name upon an action=rollbac...

PT-2023-13479 · Unknown · Metagauss Download Plugin

Name of the Vulnerable Software and Affected Versions: Metagauss Download Plugin versions = 2.0.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-24301 · WordPress · Woocommerce Product Vendors

Name of the Vulnerable Software and Affected Versions: WooCommerce Product Vendors plugin versions = 2.1.76 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowi...

PT-2023-18638 · Conlabzgmbh · Conlabzgmbh Wp Google Tag Manager

Name of the Vulnerable Software and Affected Versions: conlabzgmbh WP Google Tag Manager plugin versions = 1.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on ...

PT-2023-15081 · WordPress · Orion Woocommerce Products Designer

Name of the Vulnerable Software and Affected Versions: ORION Woocommerce Products Designer plugin versions = 4.3.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a we...

PT-2023-15044 · WordPress · Litespeed Cache

Name of the Vulnerable Software and Affected Versions: LiteSpeed Cache plugin versions prior to 5.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

Image Builder security, bug fix, and enhancement update

cockpit-composer 45-1.0.1 - Make per page documentation links point to Oracle Linux Orabug: 32013095 45-1 - New upstream release 44-1 - New upstream release 43-1 - New upstream release 42-1 - New upstream release 40-1 - New upstream release 39-1 - New upstream release 38-1 - New upstream release...

PT-2023-21175 · Unknown · Cityboss E-Municipality

Name of the Vulnerable Software and Affected Versions: Cityboss E-municipality versions prior to 6.05 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-15076 · WordPress · Brainstorm Force Starter Templates

Name of the Vulnerable Software and Affected Versions: Brainstorm Force Starter Templates plugin versions = 3.1.20 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions...

PT-2023-21183 · Unknown · Solarview Compact Sv-Cpt-Mc310

Name of the Vulnerable Software and Affected Versions: SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 SolarView Compact SV-CPT-MC310F versions prior to Ver.8.10 Description: The issue is related to the use of hard-coded credentials, which may allow a remote authenticated attacker to lo...

PT-2023-20903

Name of the Vulnerable Software and Affected Versions Competition Management System versions prior to 23.07 Description The issue allows for authentication abuse and bypass through an authorization bypass vulnerability. This is due to a user-controlled key in the Finex Media Competition Managemen...

PT-2023-19152 · WordPress · User Meta Manager

Name of the Vulnerable Software and Affected Versions: User Meta Manager plugin versions = 3.4.9 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-15210 · Aram Kocharyan · Crayon Syntax Highlighter

Name of the Vulnerable Software and Affected Versions: Aram Kocharyan Crayon Syntax Highlighter plugin versions = 2.8.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-21073 · WordPress · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg plugin for WordPress versions up to, and including, 2.7.9.8 Description: The issue is related to Stored Cross-Site Scripting via the 'gh form' shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2023-20972 · WordPress · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg plugin for WordPress versions up to, and including, 2.7.9.8 Description: The issue is related to a missing capability check on the check license functions, allowing authenticated attackers with subscriber-level permissions and abov...

PT-2023-23401 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad version 5.4.0 Description: An issue in the software allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers are also able to gain unauthorized access to existin...

PT-2023-21119 · WordPress · Ramon Fincken Mass Delete Unused Tags

Name of the Vulnerable Software and Affected Versions: Ramon Fincken Mass Delete Unused Tags plugin versions = 2.0.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to perform unintended actions on a web applicati...

PT-2023-22724 · Thimpress · Thimpress Learnpress Export Import Plugin

Name of the Vulnerable Software and Affected Versions: ThimPress LearnPress Export Import plugin versions prior to 4.0.3 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...