PT-2023-19338 · Wow Company · Wow-Company Bubble Menu

Name of the Vulnerable Software and Affected Versions: Wow-Company Bubble Menu – circle floating menu plugin versions = 3.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which can lead to form deletion. Recommendations: For Wow-Company Bubble Menu – circle floating...

PT-2023-16192 · Forgerock · Forgerock Access Management Web Policy Agent

Name of the Vulnerable Software and Affected Versions: ForgeRock Access Management Web Policy Agent versions up to 5.10.1 Description: The issue is related to a Relative Path Traversal vulnerability that allows Authentication Bypass in the ForgeRock Access Management Web Policy Agent...

SUSE-SU-2023:0527-1 Security update for php8

This update for php8 fixes the following issues: php8 was updated to version 8.0.28: - CVE-2023-0568: Fixed NULL byte off-by-one in phpcheckspecificopenbasedir bnc1208366. - CVE-2023-0662: Fixed DoS vulnerability when parsing multipart request body bnc1208367...

PT-2023-2088 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.18 Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability in the pimcore/pimcore GitHub repository. This vulnerability is associated with the blacklistAction function, whi...

PT-2023-2004 · Hitachi · Hitachi Ops Center Analyzer

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Analyzer versions 10.9.0-00 through 10.9.0-00 Description: The issue is related to incorrect default permissions in the Hitachi Ops Center Analyzer RAID Agent component, allowing local users to read and write specific files...

PT-2023-16385 · WordPress · All In One Seo Pack

Name of the Vulnerable Software and Affected Versions: All in One SEO Pack plugin for WordPress versions up to, and including, 4.2.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with...

CVE-2023-25621 Apache Sling does not allow to handle i18n content in a secure way

Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it allows an author to change any text or...

PT-2023-15030 · Squaredup · Squaredup Dashboard Server Scom Edition

Name of the Vulnerable Software and Affected Versions: SquaredUp Dashboard Server SCOM edition versions prior to 5.7.1 GA Description: The issue allows for XSS. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world...

USN-5739-2 mariadb-10.3, mariadb-10.6 regression

USN-5739-1 fixed vulnerabilities in MariaDB. It caused a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: MariaDB has been updated to 10.3.38 in Ubuntu 20.04 LTS and to 10.6.12 in Ubuntu 22.04 LTS and Ubuntu 22.10...

SUSE-SU-2023:0469-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Updated to version 102.8.0 ESR bsc1208144: - CVE-2023-25728: Fixed content security policy leak in violation reports using iframes. - CVE-2023-25730: Fixed screen hijack via browser fullscreen mode. - CVE-2023-25743: Fixed Fullscreen...

PT-2023-11824 · WordPress · Spectra

Name of the Vulnerable Software and Affected Versions: Spectra WordPress plugin versions prior to 1.15.0 Description: The issue allows contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks due to insufficient sanitization of user input in the style HTML attribute...

PT-2023-16229 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads WordPress plugin versions prior to 3.1.0.5 Description: The issue concerns the lack of validation and escaping of certain block options in the Easy Digital Downloads WordPress plugin, which could allow users with the...

PT-2023-16363 · WordPress · Gs Portfolio

Name of the Vulnerable Software and Affected Versions: GS Portfolio for Envato WordPress plugin versions prior to 1.4.0 Description: The issue concerns the GS Portfolio for Envato WordPress plugin, which does not properly validate and escape certain shortcode attributes before outputting them in ...

PT-2023-12187 · Vditor · Vditor

Name of the Vulnerable Software and Affected Versions: Vditor versions prior to 3.8.7 Description: Vditor is a browser-side Markdown editor. The issue at hand is a copy-paste cross-site scripting XSS problem. For this particular type of XSS, the victim needs to be fooled into copying a malicious...

PT-2023-12183 · Unknown · Mind-Elixir

Name of the Vulnerable Software and Affected Versions: Mind-elixir versions prior to 0.18.1 Description: The issue is related to cross-site scripting when handling untrusted menus in Mind-elixir, a free, open source mind map core. Recommendations: For versions prior to 0.18.1, update to version...

PT-2023-16616 · Pixelfed · Pixelfed

Name of the Vulnerable Software and Affected Versions: pixelfed/pixelfed versions prior to 0.11.4 Description: The issue is related to improper authorization in the GitHub repository pixelfed/pixelfed. Recommendations: For versions prior to 0.11.4, update to version 0.11.4 or later to resolve the...

PT-2023-13776 · Ibm · Ibm Sterling B2B Integrator Standard Edition

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0 through 6.0.3.7 IBM Sterling B2B Integrator Standard Edition versions 6.1.0.0 through 6.1.2.0 Description: The issue is related to improper access controls, which could allow an...

GHSA-R6CH-MQF9-QC9W Regular Expression Denial of Service in Headers

Impact The Headers.set and Headers.append methods are vulnerable to Regular Expression Denial of Service ReDoS attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize utility function...

CVE-2023-25153 containerd OCI image importer memory exhaustion

containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug h...

PT-2023-13472 · Intel · Fcs Server

Name of the Vulnerable Software and Affected Versions: FCS Server software maintained by Intel versions prior to 1.1.79.3 Description: The issue is related to an uncaught exception in the FCS Server software, which may allow a privileged user to potentially enable denial of service via physical...