GHSA-23QF-3JF9-H3Q9 Apache NiFi Insufficient Property Validation vulnerability

Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custo...

SUSE-SU-2023:3341-1 Security update for postgresql12

This update for postgresql12 fixes the following issues: - Update to 12.16 - CVE-2023-39417: Fixed potential SQL injection for trusted extensions. bsc1214059...

PT-2023-27303 · Dispatch · Dispatch Plugin - Basic Authentication Provider +1

Name of the Vulnerable Software and Affected Versions: Dispatch versions prior to 20230817 Description: Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the Dispatch Plugin - Basic...

PT-2023-27301 · Unknown · Turbowarp Desktop

Name of the Vulnerable Software and Affected Versions: TurboWarp Desktop versions prior to 1.8.0 Description: TurboWarp is a desktop application that compiles scratch projects to JavaScript. The issue allows a malicious project or custom extension to read arbitrary files from disk and upload them...

PT-2023-27351 · Empowerid · Empowerid

Name of the Vulnerable Software and Affected Versions: EmpowerID versions prior to 7.205.0.1 Description: The issue allows an attacker to bypass a multi-factor authentication MFA requirement if the first factor, which includes the username and password, is known. This is possible because knowing...

Avalanche Vulnerabilities Addressed in 6.4.1

Securtiy Advisory for Avalanche 6.4 and older. To resolve these vulnerabilities, please upgrade to Avalanche 6.4.1.207 Download Page: https://www.wavelink.com/Download-AvalancheMobile-Device-Management-Software/ Release Notes:...

PT-2023-24731 · Keyfactor · Keyfactor Ejbca

Name of the Vulnerable Software and Affected Versions: Keyfactor EJBCA versions prior to 8.0.0 Description: The issue is related to an authentication problem in the RA web certificate distribution servlet, specifically at the "/ejbca/ra/cert" endpoint. This can lead to a partial denial of service...

Information Exposure

Overview logstash-core is a scalable log and event management tool. Affected versions of this package are vulnerable to Information Exposure. Elasticsearch Output plugin would log to file HTTP basic auth credentials when updating connections after sniffing. Remediation Upgrade logstash-core to...

PT-2023-24955 · Hashicorp +2 · Hashicorp Vault +3

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.13.5 HashiCorp Vault and Vault Enterprise versions prior to 1.14.1 Description: The issue allows for user enumeration when using the LDAP auth method. An attacker can submit requests fo...

PT-2023-4554

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 3.0 OpenSSL versions prior to 3.1 Description The issue is related to the functions DH check, DH check ex, and EVP PKEY param check in the OpenSSL library. These functions can cause excessive delays when checking...

PT-2023-26544

Name of the Vulnerable Software and Affected Versions PaddlePaddle versions prior to 2.5.0 Description The issue is related to a heap buffer overflow in paddle.trace, which can lead to a denial of service, information disclosure, or potentially more severe damage. Recommendations For versions pri...

PYSEC-2023-130

Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the...

CVE-2023-36826

Summary of CVE-2023-36826 (Sentry): Before 23.5.2, authenticated users could download a debug or artifact bundle from arbitrary organizations/projects using a known bundle ID, without needing membership or project permissions. Root cause: authorization checks were not properly scoped on the retri...

PT-2023-25715 · Sentry · Sentry

Name of the Vulnerable Software and Affected Versions: Sentry versions 8.21.0 through 23.5.1 Description: An authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID, without needing to be a member of the organization or having...

PT-2023-26184 · Kubepi · Kubepi

Name of the Vulnerable Software and Affected Versions: KubePi versions prior to 1.6.5 Description: A normal user in KubePi, an open-source Kubernetes management panel, has the permission to create or update users. By editing the isadmin value in the request, any user can become an admin, thus...

Sql injection

A vulnerability was found in Weaver e-cology. It has been rated as critical. This issue affects some unknown processing of the file filelFileDownloadForOutDoc.class of the component HTTP POST Request Handler. The manipulation of the argument fileid with the input 1+WAITFOR+DELAY leads to sql...

PT-2023-23817 · Dell · Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Wyse Management Suite versions prior to 4.0 Description: The issue allows an authenticated malicious user with local access to the system to read sensitive information written to log files. This is achieved by exploiting a sensitive informati...

Citrix Endpoint Management (aka XenMobile Server) 10.15.0 Rolling Patch 3

Package name: xms10.15.0.10327.bin For: XenMobile Server 10.15.0 Deployment type: On-premises only Replaces: xms10.15.0.10220.bin and xms10.15.0.10125.bin Date: July 2023 Languages supported: English US Important notes about this update As a best practice, Citrix recommends that you install this...

Insecure Defaults

Overview Affected versions of this package are vulnerable to Insecure Defaults. The library poses a major security risk that can likely be exploited to extract sensitive information or fully compromise the application. An attacker is be able to perform character by character brute-force of...

PT-2023-25871 · Warpgate · Warpgate

Name of the Vulnerable Software and Affected Versions: Warpgate versions prior to 0.7.3 Description: Warpgate is an SSH, HTTPS, and MySQL bastion host for Linux that does not require special client apps. An issue exists where an attacker may authenticate as another user when logging in as a user...