PT-2023-3901 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.27.0 Envoy versions prior to 1.26.4 Envoy versions prior to 1.25.9 Envoy versions prior to 1.24.10 Envoy versions prior to 1.23.12 Description: The issue is related to the handling of mixed-case schemes in HTTP/2 by...

PT-2023-4056 · Apple · Ios +4

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 16.6 iPadOS versions prior to 16.6 macOS Ventura versions prior to 13.5 watchOS versions prior to 9.6 Description: The issue is related to a buffer overflow in memory operations, which may allow an app to execute arbitra...

PT-2023-7494 · Hazelcast · Hazelcast

Name of the Vulnerable Software and Affected Versions: Hazelcast versions 5.0 through 5.0.4 Hazelcast versions 5.1 through 5.1.6 Hazelcast versions 5.2 through 5.2.3 Hazelcast IMDG versions prior to 4.2.z Description: The issue is related to insufficient authorization procedures in Hazelcast,...

PT-2023-20540 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.1 through 15.11.9 GitLab CE/EE versions 16.0 through 16.0.5 GitLab CE/EE versions 16.1 through 16.1.0 Description: An issue has been discovered that allows a maintainer to modify a webhook URL and leak masked webhook...

PT-2023-8007 · Qt Company +8 · Qt +8

Name of the Vulnerable Software and Affected Versions: Qt versions prior to 5.15.15 Qt versions 6.x prior to 6.2.9 Qt versions 6.3.x through 6.5.x prior to 6.5.2 Description: The issue is related to a crafted XML string that can cause an application crash in QXmlStreamReader. This occurs when a...

SUSE-RU-2023:2595-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: branch-network-formula: - Update to version 0.1.1680167239.23f2fec Remove unnecessary import of 'salt.ext.six' cpu-mitigations-formula: - Update to version 0.5.0: Mark all SUSE Linux Enterprise 15 SP4 and newer and openSUSE 15.4 and newer as supported...

PT-2023-25311 · K-Search · Ke Search

Name of the Vulnerable Software and Affected Versions: ke search extension versions prior to 4.0.3 ke search extension versions 4.1.x through 4.6.x before 4.6.6 ke search extension versions 5.x before 5.0.2 Description: The issue allows XSS via indexed data. Recommendations: For ke search extensi...

PT-2023-25161 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.399 and earlier, LTS versions 2.387.3 and earlier Description: The issue arises when POST requests are sent to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a...

PT-2023-22965 · Kb-Ahr08D +3 · Kb-Ahr08D +5

Name of the Vulnerable Software and Affected Versions: KB-AHR04D versions prior to 91110.1.101106.78 KB-AHR08D versions prior to 91210.1.101106.78 KB-AHR16D versions prior to 91310.1.101106.78 KB-IRIP04A versions prior to 95110.1.100290.78A KB-IRIP08A versions prior to 95210.1.100290.78A KB-IRIP1...

Vulnerabilities fixed in Google Chrome

Google has fixed two vulnerabilities in Chrome. Of one vulnerability no substantive information or CVE attribute has been disclosed stated. The vulnerability with attribute CVE-2023-3079 allows a malicious person to remotely capable of executing arbitrary code in the scope of the browser,...

PT-2023-7396 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.0.5 Splunk Enterprise versions prior to 8.2.11 Splunk Enterprise versions prior to 8.1.14 Splunk Cloud Platform versions prior to 9.0.2303.100 Description: The issue is related to insufficient exception...

PT-2023-3581 · Qt Company +4 · Qt +4

Name of the Vulnerable Software and Affected Versions: Qt versions prior to 5.15.14 Qt versions 6.x prior to 6.2.9 Qt versions 6.3.x through 6.5.x prior to 6.5.1 Description: An issue in Qt Network incorrectly parses the strict-transport-security HSTS header, allowing unencrypted connections to b...

SUSE-SU-2023:1838-1 Security update for python-crcmod, python-cryptography, python-cryptography-vectors

This update for python-crcmod, python-cryptography, python-cryptography-vectors contains the following fixes: Changes in python-crcmod: - Include in SLE-15 bsc1177083, jscPM-2730, jscSLE-18312 - Include in SLE-15 bsc1181995, jscECO-3329, jscPM-2475 - Cleanup spec file - Use fdupes - Do not bundle...

PT-2023-21146 · Mendix · Mendix Forgot Password

Name of the Vulnerable Software and Affected Versions: Mendix Forgot Password Mendix 7 compatible versions prior to V3.7.1 Mendix Forgot Password Mendix 8 compatible versions prior to V4.1.1 Mendix Forgot Password Mendix 9 compatible versions prior to V5.1.1 Description: The affected versions of...

PT-2023-19186 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.9 Description: An improper authentication issue was identified that allowed unauthorized modification of other users' secret gists by authenticating through an SSH certificate authority, provided t...

PT-2023-21572 · Russh · Russh

Name of the Vulnerable Software and Affected Versions: russh versions 0.34.0 through 0.36.1 russh versions 0.37.0 Description: The issue is related to insufficient Diffie-Hellman key validation, which can lead to insecure shared secrets and break confidentiality. This can result in eavesdropping,...

PT-2023-20662 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 11.6-rc-1 through 14.8 XWiki Platform versions 14.4.0 through 14.4.5 XWiki Platform versions 13.10.0 through 13.10.9 Description: The XWiki Platform is a generic wiki platform where comments are supposed to be executed...

SUSE CVE-2009-3872

Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.127, and SDK and JRE 1.4.x before 1.4.224 allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862969...

SUSE CVE-2022-24714

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may...

PT-2023-20170 · Unknown · @Backstage/Plugin-Catalog-Backend +2

Name of the Vulnerable Software and Affected Versions: @backstage/catalog-model versions prior to 1.2.0 @backstage/core-components versions prior to 0.12.4 @backstage/plugin-catalog-backend versions prior to 1.7.2 Description: This issue allows a malicious actor with access to add or modify conte...