CVE-2023-42798 AutomataCI Release Job Can Revert Repo to First Commit

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the PROJECTPATHRELEA...

Two Qt security advisories: GDI Font Engine & WebP image format

An issue on Windows with the GDI font engine has been reported and has been assigned the CVE id CVE-2023-43114. When corrupt font data is passed to the GDI font engine via QFontDatabase::addApplicationFontFromData then it can trigger a crash in the application. Solution: As a workaround, validate...

Command injection

systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to wifiConnections,...

GHSA-HC5C-R8M5-2GFH plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait

Impact There is a stored cross site scripting vulnerability for SVG images uploaded in user portraits. Note that a page that uses an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first ne...

CVE-2023-42458

Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the...

CVE-2023-42810 systeminformation SSID Command Injection Vulnerability

systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to wifiConnections,...

GHSA-J646-GJ5P-P45G CefSharp affected by heap buffer overflow in WebP

Google is aware that an exploit for CVE-2023-4863 exists in the wild. Description Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Chromium security severity: Critical References -...

GHSA-2R3C-M6V7-9354 sudo-rs Session File Relative Path Traversal vulnerability

Background Sudo-rs allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to re-authenticate themselves. Supporting...

CVE-2023-42458 Zope vulnerable to Stored Cross Site Scripting with SVG images

Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the...

CVE-2023-42456 sudo-rs Session File Relative Path Traversal vulnerability

Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to...

CVE-2023-42456

Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to...

PYSEC-2023-178

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less...

PT-2023-5411 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G version 1.0.2B05 Description: The issue is related to a stack overflow in the SetWifiDownSettings function of the D-Link DIR-823G router's firmware, which can be exploited by a remote attacker to impact the confidentiality,...

PT-2023-5415 · D Link · D-Link Dir-806

Name of the Vulnerable Software and Affected Versions: D-LINK DIR-806 versions DIR806A1 FW100CNb11 Description: The issue is related to a lack of proper data cleaning at the management level, which can be exploited by a remote attacker to execute arbitrary commands using the HTTP ST parameter. Th...

PT-2023-28001 · Unknown · Student Management System

Name of the Vulnerable Software and Affected Versions: Student Management System versions 1.2.3 and earlier Description: A reflected cross-site scripting XSS vulnerability in the Search Student function allows attackers to execute arbitrary Javascript in the context of a victim user's browser via...

PT-2023-6514 · Unknown · Plone.Rest

Name of the Vulnerable Software and Affected Versions: plone.rest versions 2.0.0 through 2.0.1 plone.rest versions 3.0.0 through 3.0.1 Description: The issue is related to the ++api++ traverser in plone.rest, which allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. When...

PT-2023-5412 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G version 1.0.2B05 Description: The issue is related to a stack overflow in the SetWLanRadioSecurity function, specifically via the TXPower and GuardInt parameters. This can potentially allow a remote attacker to impact the...

PT-2023-28981 · Cadence · Cadence

Name of the Vulnerable Software and Affected Versions: Cadence versions through 0.9.2 2023-08-21 Description: The issue arises from Cadence using an insecure temporary file /tmp/cadence-wineasio.reg. If a local adversary creates this file before Cadence starts, Cadence will use it, allowing the...

Jenkins temporary uploaded file created with insecure permissions

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, uploaded files processed via the Stapler web framework and the Jenkins API MultipartFormDataParser create temporary files in the system temporary directory with the default permissions for newly created files. If these permissions are overly...

Jenkins temporary plugin file created with insecure permissions

Jenkins creates a temporary file when a plugin is deployed directly from a URL. Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates this temporary file in the system temporary directory with the default permissions for newly created files. If these permissions are overly permissive, they m...