PT-2023-3608 · Zyxel · Zyxel Usg Flex Series +6

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 4.32 through 5.36 Patch 2 Zyxel USG FLEX series versions 4.50 through 5.36 Patch 2 Zyxel USG FLEX 50W series versions 4.16 through 5.36 Patch 2 Zyxel USG20W-VPN series versions 4.16 through 5.36 Patch 2 Zyxel VPN...

PT-2023-24242 · Talend · Talend Data Catalog

Name of the Vulnerable Software and Affected Versions: Talend Data Catalog versions prior to 8.0-20230413 Description: The issue concerns the remote harvesting server, which contains a "/upgrade" endpoint that allows an unauthenticated WAR file to be deployed on the server. A mitigation measure i...

GHSA-33HQ-F2MF-JM3C kyverno seccomp control can be circumvented

Impact Users of the podSecurity validate.podSecurity subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using a version value of latest. There is no effect if a version number is referenced instead. See the...

kyverno seccomp control can be circumvented

Impact Users of the podSecurity validate.podSecurity subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using a version value of latest. There is no effect if a version number is referenced instead. See the...

PT-2023-24209 · Ntpd-Rs · Ntpd-Rs

Name of the Vulnerable Software and Affected Versions: ntpd-rs versions prior to 0.3.3 Description: ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter tha...

GHSA-HH7J-PG39-Q563 toui allows user-specific variables to be shared between users

Impact Websites that use Website.uservars property in versions. Patches It affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1 Workarounds Do not use Website.uservars in websites when using versions v2.0.1 to v2.4.0. Also, do not use Website.signinuser in version v2.4.0 only. Explanation...

GHSA-P9QP-C452-F9R7 Synapse Denial of service due to incorrect application of event authorization rules during state resolution

Impact If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes se...

Synapse Denial of service due to incorrect application of event authorization rules during state resolution

Impact If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes se...

CVE-2023-32681

A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how rebuildproxies is used to recompute and reattach the Proxy-Authorization...

PT-2023-24616 · Briar · Briar

Name of the Vulnerable Software and Affected Versions: Briar versions prior to 1.5.3 Description: The issue affects the Bramble Handshake Protocol BHP in Briar, allowing eavesdroppers to decrypt network traffic between two accounts if they later compromise both accounts. However, the eavesdroppin...

PT-2023-24617 · Briar · Briar

Name of the Vulnerable Software and Affected Versions: Briar versions 1.5.3 and earlier Description: The Introduction Client in Briar does not implement out-of-band verification for the public keys of introducees. This allows an introducer to launch man-in-the-middle attacks against later private...

PT-2023-24588 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.4 through 7.4.3.48 Liferay DXP 7.4 before update 49 Description: The issue allows remote authenticated users in one virtual instance to view objects in a different virtual instance via the OAuth 2 scope...

PT-2023-23446 · Wondershare · Mobiletrans

Name of the Vulnerable Software and Affected Versions: MobileTrans version 4.0.11 Description: The issue is related to insecure permissions, allowing attackers to escalate privileges to local admin. This can be achieved by replacing the executable file, potentially leading to unauthorized access...

PT-2023-21936 · Unknown · Escan Antivirus

Name of the Vulnerable Software and Affected Versions: eScan Antivirus version 22.0.1400.2443 Description: A problematic vulnerability was found in the function 0x22E008u in the library PROCOBSRVESX.SYS of the component IoControlCode Handler. The manipulation leads to null pointer dereference. It...

PT-2023-24579

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.0 through 7.4.0 Liferay DXP 7.3 before update 14 Description A cross-site scripting XSS issue exists in the App Builder module's custom object details page, allowing remote attackers to inject arbitrary web script o...

PT-2023-21861 · Unknown · Simple Design Daily Journal +1

Name of the Vulnerable Software and Affected Versions: Simple Design Daily Journal version 1.012.GP.B Description: A vulnerability has been found in the SQLite Database component, leading to cleartext storage in a file or on disk. The manipulation can be launched on the local host. The exploit ha...

PT-2023-24494 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: Netbox version 3.5.1 Description: A stored cross-site scripting XSS issue exists in the Create Provider Accounts function, specifically at the /circuits/provider-accounts/ API endpoint, allowing attackers to execute arbitrary web scripts or...

Security Bulletin: IBM InfoSphere Information Server is affected by a remote code execution vulnerability (CVE-2023-32336)

Summary A remote code execution vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-32336 DESCRIPTION: IBM InfoSphere Information Server is affected by a remote code execution vulnerability due to insecure deserialization in an RMI service. CVSS...

SUSE CVE-2023-32082

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names not value associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limit...

Unintended leak of Proxy-Authorization header in requests

Impact Since Requests v2.3.0, Requests has been vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how rebuildproxies is used to recompute and reattach the Proxy-Authorization header to...