AZL-33331 CVE-2023-3978 affecting package packer for versions less than 1.9.5-3

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

AZL-27810 CVE-2023-3978 affecting package cert-manager for versions less than 1.11.2-14

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

AZL-27638 CVE-2023-33952 affecting package hyperv-daemons for versions less than 5.15.158.1-1

A double-free vulnerability was found in handling vmwbufferobject objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to...

AZL-35139 CVE-2022-40896 affecting package python-pygments for versions less than 2.4.2-1

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer...

AZL-37418 CVE-2023-29406 affecting package golang for versions less than 1.21.6-1

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

AZL-31659 CVE-2023-3354 affecting package qemu for versions less than 6.2.0-19

A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QE...

CVE-2023-31238

A vulnerability has been identified in SICAM P850 7KG8500-0AA00-0AA0 All versions V3.11, SICAM P850 7KG8500-0AA00-2AA0 All versions V3.11, SICAM P850 7KG8500-0AA10-0AA0 All versions V3.11, SICAM P850 7KG8500-0AA10-2AA0 All versions V3.11, SICAM P850 7KG8500-0AA30-0AA0 All versions V3.11, SICAM P8...

AZL-37337 CVE-2023-29404 affecting package golang for versions less than 1.21.6-1

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "cgo LDFLAGS" directive. The arguments for a...

AZL-27065 CVE-2023-2603 affecting package libcap for versions less than 2.60-2

A vulnerability was found in libcap. This issue occurs in the libcapstrdup function and can lead to an integer overflow if the input string is close to 4GiB...

CVE-2023-33509

KramerAV VIA GO² 4.0.1.1326 is vulnerable to SQL Injection...

CVE-2023-0600 WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi

The WP Visitor Statistics Real Time Traffic WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks...

AZL-26693 CVE-2023-29935 affecting package rust for versions less than 1.72.0-1

llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.countop && "operation was already replaced...

AZL-26393 CVE-2023-29933 affecting package llvm16 for versions less than 16.0.0-4

llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument...

AZL-26391 CVE-2023-31436 affecting package kernel for versions less than 5.15.111.1-1

qfqchangeclass in net/sched/schqfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQMINLMAX...

AZL-37484 CVE-2023-24534 affecting package golang for versions less than 1.21.6-1

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than requir...

AZL-52676 CVE-2023-24537 affecting package golang for versions less than 1.20.7-1

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow...

AZL-45378 CVE-2023-0225 affecting package samba for versions less than 4.18.3-1

A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory...

AZL-38257 CVE-2023-27538 affecting package tensorflow for versions less than 2.16.1-1

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequen...

AZL-25805 CVE-2023-27535 affecting package mysql for versions less than 8.0.34-1

An authentication bypass vulnerability exists in libcurl 8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain...

CVE-2023-28733 Stored XSS affecting the AcyMailing plugin for Joomla

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting XSS in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0...