Nautobot vulnerable to exposure of hashed user passwords via REST API

Impact In Nautobot 2.0.x, certain REST API endpoints, in combination with the ?depth= query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. Nautobot 1.x is not affected by...

GHSA-R2HW-74XV-4GQP Nautobot vulnerable to exposure of hashed user passwords via REST API

Impact In Nautobot 2.0.x, certain REST API endpoints, in combination with the ?depth= query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. Nautobot 1.x is not affected by...

Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse

Problem: Trying to create a new encrypted message with the same cocoon object generates the same ciphertext. It mostly affects MiniCocoon and Cocoon objects with custom seeds and RNGs where StdRng is used under the hood. Note: The issue does NOT affect objects created with Cocoon::new which...

GHSA-6878-6WC2-PF5H Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse

Problem: Trying to create a new encrypted message with the same cocoon object generates the same ciphertext. It mostly affects MiniCocoon and Cocoon objects with custom seeds and RNGs where StdRng is used under the hood. Note: The issue does NOT affect objects created with Cocoon::new which...

sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)

Impact Given specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. The follow is an example of a malicious entry: +2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorizedkeys This would have a potential to overwrite /root/.ssh/authorizedkeys. Within sbt's ma...

PT-2023-29982 · Tenda · Tenda W18E

Name of the Vulnerable Software and Affected Versions: Tenda W18E version 16.01.0.81576 Description: The issue is related to a stack overflow vulnerability. It occurs via the portMirrorMirroredPorts parameter in the formSetNetCheckTools function. Recommendations: For Tenda W18E version...

PT-2023-28759 · Unknown · Stb Image.H

Name of the Vulnerable Software and Affected Versions: Nothings Stb Image.h version 2.28 Description: The issue allows a remote attacker to cause a denial of service via a crafted file to the stbi load gif main function. This is a Double Free vulnerability. Recommendations: For Nothings Stb Image...

PT-2023-6593 · Tp Link · Tp-Link Tl-Wr886N

Name of the Vulnerable Software and Affected Versions: TP-LINK TL-WR886N version 7.0 3.0.14 Build 221115 Rel.56908n.bin Description: The issue is related to a stack overflow in the registerRequestHandle function, which can be exploited by a remote attacker to impact the integrity, availability, a...

PT-2023-21979 · Zscaler · Zscaler Client Connector

Name of the Vulnerable Software and Affected Versions: Zscaler Client Connector versions prior to 3.9 Description: An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. Recommendations: For...

PT-2023-8375 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance version 10.0 Description: The issue is related to the use of hard-coded credentials, such as a password or cryptographic key, in IBM Security Verify Governance. This could allow a remote attacker to disclose...

PT-2023-29838 · Userback · Userback

Name of the Vulnerable Software and Affected Versions: Userback plugin versions 1.0.13 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

GHSA-2RCP-JVR4-R259 Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables

Impact This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri...

PT-2023-29851 · Reconftw · Reconftw

Name of the Vulnerable Software and Affected Versions: reconFTW versions prior to 2.7.1.1 Description: A vulnerability has been identified in reconFTW where inadequate validation of retrieved subdomains may lead to a Remote Code Execution RCE attack. An attacker can exploit this vulnerability by...

CVE-2023-45826 Authenticated SQL Injection in leantime

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

ydb-go-sdk token in custom credentials object can leak through logs

Impact Since ydb-go-sdk/v3.48.6 if you use a custom credentials object implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using fmt.Errorf"something went wrong credentials: %q", credentials during connection to...

PT-2023-29711 · Unknown · Artifact Hub

Name of the Vulnerable Software and Affected Versions: Artifact Hub versions prior to 1.16.0 Description: Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. It includes a fine-grained authorization mechanism that...

PT-2023-6361 · Connectize · Connectize Ac21000 G6

Name of the Vulnerable Software and Affected Versions: Connectize AC21000 G6 version 641.139.1.1256 Description: The issue is related to a Cross Site Scripting XSS vulnerability that allows attackers to run arbitrary code via a crafted string when setting the Wi-Fi password in the admin panel. Th...

PT-2023-29538 · Prestashop · Creative Popup

Name of the Vulnerable Software and Affected Versions: Creative Popup versions up to 1.6.9 Description: A SQL injection issue exists in the Creative Popup module for PrestaShop, allowing a guest to perform SQL injection via the cp download popup function. Recommendations: For versions up to 1.6.9...

Security advisory: Loading invalid QML image source impacts Qt

An issue when loading an invalid QML image source has been reported and has been assigned the CVE id CVE-2023-45872. When an invalid source is used to indicate an image to be loaded is specified then it will end up trying to load it as a SVG file which will trigger a crash in Qt SVG. This does no...

AZL-31653 CVE-2023-45145 affecting package redis for versions less than 6.2.14-1

Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, another process...