Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in recursive entity expansion. Remediation Upgrade qt to version 5.15.16, 6.5.3 or higher. References - qt Issue...

CVE-2023-23585 Server DoS due to heap overflow

Experion server DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. See Honeywell Security Notification for recommendations on upgrading and versioning...

GHSA-GPQ8-963W-8QC9 RocketMQ NameServer component Code Injection vulnerability

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the...

Access Restriction Bypass

Overview Microsoft.AspNetCore.App.Runtime.win-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Access Restriction Bypass. A vulnerability exist in...

PT-2023-6483 · Apache · Apache Pulsar

Name of the Vulnerable Software and Affected Versions: Apache Pulsar versions through 2.9.4 Apache Pulsar versions from 2.10.0 through 2.10.3 Apache Pulsar version 2.11.0 Description: The issue is related to an improper authentication vulnerability in Apache Pulsar Broker, allowing a client to st...

PT-2023-14061 · Apache · Apache Ambari

Name of the Vulnerable Software and Affected Versions: Apache Ambari versions 2.7.0 through 2.7.6 Description: The issue allows a malicious authenticated user to execute arbitrary code remotely due to SpringEL injection in the server agent. Recommendations: For Apache Ambari versions 2.7.0 throug...

CVE-2023-35887

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the root...

PT-2023-7055 · Apache · Apache Mina

Name of the Vulnerable Software and Affected Versions: Apache MINA versions 1.0 through 2.9.3 Description: The issue is related to the exposure of sensitive information to unauthorized actors in Apache MINA SSHD SFTP servers that use a RootedFileSystem. Logged users may be able to discover...

PT-2023-25319

Name of the Vulnerable Software and Affected Versions Apache Airflow Hive Provider versions prior to 6.1.1 Description The issue is related to improper input validation, which allows bypassing a security check, potentially leading to remote code execution RCE via the principal parameter. This can...

PT-2023-24980 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.2.0-beta.2 Description: The issue is related to Cross-site Scripting XSS - Reflected. When an administrator restores a backup from a file, it's possible to trigger an error with a specially crafted file that can b...

PT-2023-25891 · Mediawiki +1 · Mediawiki +2

Name of the Vulnerable Software and Affected Versions: MediaWiki CheckUser extension versions through 1.39.3 Description: An issue was discovered in the "CheckUserLog API" in the CheckUser extension for MediaWiki. There is incorrect access control for visibility of hidden users. Recommendations:...

PT-2023-4820 · Xwiki +1 · Xwiki Platform +1

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.6 XWiki Platform versions prior to 15.1 XWiki Platform versions older than 14.6RC1 with CKEditor Integration extension prior to 1.64.9 Description: The issue allows any user with edit rights to edit all...

PT-2023-25581 · Alldata · Alldata

Name of the Vulnerable Software and Affected Versions: data.all versions 1.2.0 through 1.5.1 Description: The issue concerns remote code execution when a user injects Python commands into the Template field while configuring a data pipeline. This can only be triggered by authenticated users...

'ERROR: Minimum Cache Memory Not Configured' When Setting Global Cache Parameter

After upgrading to version 13.1 Build 42.47+from any previous version, you may notice a different behavior when configuring the global cache parameter. You are unable to set the cache global parameters unless the value of "-memLimit" is=N 4MB N is the number of NSPPEs. Attempting to set the cache...

CVE-2023-28094

Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials...

SUSE-SU-2023:2572-1 Security update for salt

This update for salt fixes the following issues: - Update to Salt release version 3006.0 jscPED-4361 See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add missing patch after rebase to fix collections Mapping issues - Add python3-looseversion as new dependency...

PT-2023-25363 · Unknown · Eventprime

Name of the Vulnerable Software and Affected Versions: EventPrime plugin versions prior to 3.0.6 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into a website, which would the...

PT-2023-24892 · Pybb · Pybb

Name of the Vulnerable Software and Affected Versions: PyBB versions 0.1.0 Description: A manual code review of the PyBB bulletin board server revealed a vulnerability that allows users to submit any type of HTML tag, which can be executed. For example, a malicious tag, such as xss, can be used t...

Information Exposure

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Information Exposure due to the improper handling of sensitive information. An attacker can leak minor user data by exploiting the security feature bypass. Remediation...

Missing Support for Integrity Check

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Missing Support for Integrity Check due to improper handling of authorization checks. An attacker can bypass security features and access restricted functionalities without...