PT-2023-29171 · WordPress · Hometory Mang Board Wp

Name of the Vulnerable Software and Affected Versions: Hometory Mang Board WP plugin versions 1.7.6 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on...

Zope Cross-Site Scripting Vulnerability

Zope is a set of object-oriented, open source web application servers written in the Python language by the Zope community. A cross-site scripting vulnerability exists in Zope, which stems from a stored cross-site scripting XSS vulnerability in the title attribute of the Zope Management Interface...

PT-2023-32077 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac versions prior to 2.2.2-DEV Description: The issue is an out-of-bounds read in the GitHub repository gpac/gpac. Recommendations: For versions prior to 2.2.2-DEV, update to version 2.2.2-DEV or later to resolve the issue...

PT-2023-5987 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-beta1 and earlier Adobe Commerce versions 2.4.6-p2 and earlier Adobe Commerce versions 2.4.5-p4 and earlier Adobe Commerce versions 2.4.4-p5 and earlier Description: The issue is related to an Improper...

Cilium Access Control Error Vulnerability

Cilium is an open source software. It is used to provide and transparently secure network connectivity and load balancing between application workloads, such as application containers or processes. An access control error vulnerability exists in Cilium that stems from allowing an attacker to bypa...

Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM WebSphere Application Server Liberty is vulnerable to Identity Spoofing (CVE-2022-22476)

Summary IBM WebSphere Application Server Liberty and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request. This affects The IBM® Engineering Lifecycle Engineering product using WebSphere Application Server Liberty versions 22.0.0.7 and prior...

RKE2 Security Vulnerability

RKE2 is the next generation Kubernetes distribution for Rancher. A security vulnerability exists in SUSE RKE2 that stems from the presence of a resource allocation error issue. An attacker can exploit the vulnerability to access the apiserver/supervisor port of the K3s server, resulting in a deni...

CVE-2023-38205

Adobe ColdFusion versions 2018u18 and earlier, 2021u8 and earlier and 2023u2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...

GHSA-PMXQ-PJ47-J8J4 Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes

Impact The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured using the domain names, and in such a case the configuration is vulnerable to t...

PT-2023-25936 · Samsung · Exynos Auto T5123 +15

Name of the Vulnerable Software and Affected Versions: Samsung Exynos Mobile Processor, Automotive Processor, and Modem versions Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920,...

PT-2023-22924 · Samsung · Samsung Blockchain Keystore

Name of the Vulnerable Software and Affected Versions: Samsung Blockchain Keystore versions prior to 1.3.13.5 Description: The issue is related to a Protection Mechanism Failure in the bc tui trustlet, allowing a local attacker to execute arbitrary code. Recommendations: For versions prior to...

OESA-2023-1579 qt security update

Qt pronounced as "cute", not "cu-tee" is a cross-platform framework that is usually used as a graphical toolkit, although it is also very helpful in creating CLI applications. It runs on the three major desktop OSes, as well as on mobile OSes, such as Symbian, Nokia Belle, Meego Harmattan, MeeGo ...

UBUNTU-CVE-2023-3210

An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content...

UBUNTU-CVE-2023-4513

BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file...

GHSA-CR5Q-6Q9F-RQ6Q Active Support Possibly Discloses Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...

Possible File Disclosure of Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...

PT-2023-26518 · Unknown · Lan-Wh300N/Re

Name of the Vulnerable Software and Affected Versions: LAN-WH300N/RE versions all Description: A hidden functionality vulnerability allows an authenticated user to execute arbitrary OS commands on a certain management console. Recommendations: For LAN-WH300N/RE all versions, at the moment, there ...

CVE-2023-36844

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables...

UBUNTU-CVE-2023-39945

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a data submessage sent to PDP port raises unhandled BadParamException in fastcdr, which in turn crashes fastdds. Versions 2.11.0,...

CVE-2023-40253

CVE-2023-40253 describes an Improper Authentication vulnerability in Genians Genian NAC products and Genian ZTNA. Affected: Genian NAC v4.0.0–v4.0.155; Genian NAC v5.0.0–v5.0.42; Genian NAC Suite v5.0.0–v5.0.54; Genian ZTNA v6.0.0–v6.0.15. Root cause: authentication abuse/misuse due to improper a...