OESA-2023-1066 vim security update

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Securi...

PT-2023-18215 · Samsung · Samsung Cloud

Name of the Vulnerable Software and Affected Versions: Samsung Cloud versions prior to 5.3.0.32 Description: A path traversal issue exists, allowing an attacker to access a specific png file. Recommendations: For versions prior to 5.3.0.32, update to version 5.3.0.32 or later to resolve the issue...

CVE-2023-25150 Document content of files can be obtained through Collabora for files of other users

Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora can obtain the content of other users...

PT-2023-20046 · Caphyon · Caphyon Advanced Installer

Name of the Vulnerable Software and Affected Versions: Caphyon Advanced Installer versions 20.0 and below Description: The issue concerns a privilege escalation in the MSI repair functionality, allowing attackers to access and manipulate system files. Recommendations: For versions 20.0 and below,...

PT-2023-14595 · Unknown · Smartpower Web

Name of the Vulnerable Software and Affected Versions: Smartpower Web versions prior to 23.01.01 Description: The issue affects Smartpower Web, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. This enables attackers to inject malicious scripts...

PT-2023-1580 · Dell · Dell Command | Intel Vpro Out Of Band

Name of the Vulnerable Software and Affected Versions: Dell Command Intel vPro Out of Band versions prior to 4.3.1 Description: The issue is related to an Improper Authorization vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability to write arbitrary...

PT-2023-12957 · Caddy · Caddy

Name of the Vulnerable Software and Affected Versions: Caddy version 2.4.6 Description: The issue allows attackers to redirect users to phishing websites via crafted URLs due to improper request sanitization. A crafted URL can cause the static file handler to redirect to an attacker-chosen URL,...

PT-2023-12285 · Gurock · Gurock Testrail

Name of the Vulnerable Software and Affected Versions: Gurock TestRail versions prior to 7.1.2 Description: The issue allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports. This is a Cross Site Scripting XSS issue...

Django 3.2.x < 3.2.17, 4.0.x < 4.0.9, 4.1.x < 4.1.6 DoS Vulnerability - Windows

Django is prone to a denial of service DoS vulnerability. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

PT-2023-1628 · F5 · Big-Ip Apm

Name of the Vulnerable Software and Affected Versions: BIG-IP APM versions 13.1.x and 14.1.x through 14.1.5.2 Description: The issue is related to the BIG-IP APM system, where undisclosed requests may cause the Traffic Management Microkernel TMM to terminate when configured with specific elements...

PT-2023-7393 · F5 · Big-Ip Spk +2

Name of the Vulnerable Software and Affected Versions: BIG-IP Virtual Edition versions 15.1.4 through 15.1.8 BIG-IP Virtual Edition versions 14.1.5 through 14.1.5.3 BIG-IP SPK versions 1.5.0 through 1.6.0 Description: The issue is related to the Traffic Management Microkernel TMM terminating when...

CVE-2023-0341 Stack Buffer Overflow in editorconfig-core-c

A stack buffer overflow exists in the ecglob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over th...

PT-2023-34830 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.89 Description: A NULL-deref issue was discovered in the init error path of the EFI module. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2023-34765 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.8 Description: The issue is related to the Bluetooth driver shutdown on closed serdev. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

PT-2023-34814 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.90 Description: A potential issue exists in the Linux Kernel, specifically in the spk ttyio release function, which may lead to a null pointer dereference. The actual impact and attack plausibility have no...

PT-2023-34749 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.8 Description: The issue concerns a qgroup record without old roots populated in btrfs, which may potentially lead to security vulnerabilities. The actual impact and attack plausibility have not yet been...

PT-2023-34760 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.8 Description: A memory leak was discovered in the do mmap error path. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v6.1.8, update ...

PT-2023-34763 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.8 Description: The issue is related to the f2fs component, where a panic can be avoided if the extent tree is not created. The actual impact and attack plausibility have not yet been proven. Recommendations...

PT-2023-34844 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.89 Description: The issue is related to a use-after-free UAF vulnerability in the drm/virtio component. It was introduced in version v4.4 and fixed in version v5.15.89. The actual impact and attack...

PT-2023-34825 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.90 Description: The issue is related to the btrfs function run one delayed ref, which always reports an error. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...