Security Bulletin: Vulnerability of jython-standalone-2.7.0.jar have affected APM WebSphere Application Server Agent and APM Tomcat Agent

Summary APM WebSphere Application Server Agent and APM Tomcat Agent are vulnerable to jython-standalone-2.7.0.jar CVE-2013-2027. The workaround includes jython-standalone-2.7.0.jar upgraded to jython-standalone-2.7.3.jar. Vulnerability Details CVEID:CVE-2013-2027 DESCRIPTION: Jython could allow a...

PT-2023-27947 · Binalyze · Irec.Sys

Name of the Vulnerable Software and Affected Versions: Binalyze IREC.sys versions 3.11.0 and earlier Description: An issue in Binalyze IREC.sys allows a local attacker to execute arbitrary code and escalate privileges via the fun 1400084d0 function in the IREC.sys driver. Recommendations: For...

PT-2023-5691

Name of the Vulnerable Software and Affected Versions: Cisco IOS and IOS XE Software affected versions not specified Description: A vulnerability in the Cisco Group Encrypted Transport VPN GET VPN feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacke...

PT-2023-29089 · Unknown · Pgyer Codefever

Name of the Vulnerable Software and Affected Versions: PGYER codefever version 2023.8.14-2ce4006 Description: An issue in the code allows a remote attacker to execute arbitrary code via a crafted request to the branchList component. Recommendations: For version 2023.8.14-2ce4006, as a temporary...

PT-2023-5671 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10U version 1.0 US AC10UV1.0RTL V15.03.06.49 multi TDE01 Description: The issue is related to a stack overflow via the formSetClientState function, which can be exploited by a remote attacker to impact the confidentiality, integrity,...

PT-2023-5639 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 117.0.5938.132 Description: The issue is related to a use after free in the Extensions component of Google Chrome, which could allow an attacker to exploit heap corruption via a crafted HTML page if a user is...

sing-box vulnerable to improper authentication in the SOCKS inbound

Impact This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication. Patches Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions. Workarounds Don't expose the SOCKS5 inbound to insecure environments...

Vyper's `_abi_decode` input not validated in complex expressions

Impact abidecode does not validate input when it is nested in an expression. the following example gets correctly validated bounds checked: vyper x: int128 = abidecodeslicemsg.data, 4, 32, int128 however, the following example is not bounds checked vyper @external def abidecodex: uint256 - uint25...

PT-2023-6822 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.10 Description: The issue is related to information disclosure in the GLPI system. Exploitation of this issue may allow a remote attacker to disclose protected information. An API user can enumerate sensitive field...

PT-2023-27503 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14 Description: This issue concerns a shortcut that may output sensitive user data without consent. The problem was addressed by adding an additional prompt for user consent. Recommendations: For versions prior to 14,...

PT-2023-8482 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14 Description: The issue is related to errors in security settings of the macOS operating system's isolated software environment, Sandbox. It may allow an attacker to gain unauthorized access to removable information...

User with system administrator privilege can search restricted pages.

h3. Issue Summary Starting Confluence 8.5.1 when a user is granted System administrator permission at Global permissions. The user can search for Restricted content and the restricted page gets displayed in search, when tried to access it says "Page can't be found". This behaviour is not...

Important: redis

Issue Overview: Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis BIT command are vulnerable to integ...

PT-2023-6729 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki version 1.40.0 Description: The issue exists due to the lack of protection for the web page structure. A remote attacker with a low-privileged user account can exploit this by sending a malicious link to the instance administrator,...

PT-2023-28130 · Codestag · Codestag Stagtools

Name of the Vulnerable Software and Affected Versions: Codestag StagTools plugin versions = 2.3.7 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal user...

Important: redis

Issue Overview: Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involv...

CVE-2023-42798

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the PROJECTPATHRELEA...

CVE-2023-42798

AutomataCI is exposed to a release-job issue in 1.4.1 and earlier where the release job can reset the repo root to the very first commit. A fix exists in version 1.5.0. The recommended workaround is to ensure the PROJECT_PATH_RELEASE (e.g., releases/) directory is manually and actually git-cloned...

CVE-2023-42798 AutomataCI Release Job Can Revert Repo to First Commit

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the PROJECTPATHRELEA...

CVE-2023-42798 AutomataCI Release Job Can Revert Repo to First Commit

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the PROJECTPATHRELEA...