PT-2023-6101 · Ipswitch · Ws Ftp Server

Name of the Vulnerable Software and Affected Versions: WS FTP Server versions 8.7.0 through 8.7.3 WS FTP Server versions 8.8.0 through 8.8.1 Description: A reflected cross-site scripting XSS vulnerability exists in WS FTP Server's Ad Hoc Transfer module. This vulnerability can be leveraged by an...

PT-2023-5688

Name of the Vulnerable Software and Affected Versions WS FTP Server versions prior to 8.7.4 and 8.8.2 Description The issue is related to a .NET deserialization vulnerability in the Ad Hoc Transfer module of WS FTP Server. This vulnerability can be exploited by a pre-authenticated attacker to...

WordPress Ad Inserter Plugin <= 2.7.30 is vulnerable to Sensitive Data Exposure

Software Ad Inserter Type Plugin Vulnerable versions = 2.7.30 Fixed in 2.7.31 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-4645 Patch priority Low CVSS severity Low 5.3 Developer Igor Funa PSID d835574a9ec2 Credits Marco Wotschka Required privilege...

WordPress Ad Inserter Plugin <= 2.7.30 is vulnerable to Sensitive Data Exposure

Software Ad Inserter Type Plugin Vulnerable versions = 2.7.30 Fixed in 2.7.31 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-4668 Patch priority Low CVSS severity Low 5.3 Developer Igor Funa PSID c1880bc4c6b9 Credits Marco Wotschka Required privilege...

How To Enable DsAuthAzureAdNestedGroups Feature For Azure AD Nested Groups

Adding a group as a member of another group nesting is supported with the DSAuthAzureAdNestedGroups feature enabled...

GLSA-202309-06 : Samba: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202309-06 Samba: Multiple Vulnerabilities - Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a...

Revive Adserver 跨站脚本漏洞

Revive Adserver is an open source ad serving system that allows advertisers, publishers, and networks to place ads on multiple platforms e.g., websites, apps, video players and supports ad effectiveness tracking, campaign management, and placement rule definition. Revive Adserver suffers from a...

[SECURITY] [DLA 3563-1] samba security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3563-1 [email protected] https://www.debian.org/lts/security/ Lee Garrett September 12, 2023 https://wiki.debian.org/LTS -...

A week in security (September 4 - September 10)

Last week on Malwarebytes Labs: Supply chain related security risks, and how to protect against them Password-stealing Chrome extension smuggled on to Web Store Smart chastity device exposes sensitive user data X wants your biometric data Mac users targeted in new malvertising campaign delivering...

Chrome's "Enhanced Ad Privacy": What you need to know

Users of Google's Chrome web browser may wish to dig into their privacy settings as a new feature regarding advertising privacy slowly rolls out to the masses. Googles "Enhanced Ad Privacy" feature may soon appear in your browser, tied to choices regarding a new Chrome feature named Topics. This ...

GHSA-HJ7P-H74J-6GXJ Non-constant time nonce comparison in Jenkins Microsoft Entra ID (previously Azure AD) Plugin

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

Non-constant time nonce comparison in Jenkins Microsoft Entra ID (previously Azure AD) Plugin

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

CVE-2023-41935

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

CVE-2023-41935

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

Cross site request forgery (csrf)

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

CVE-2023-41935

The CVE concerns Jenkins Azure AD Plugin versions 396.v86ce29279947 and earlier (except 378.380.v545b_1154b_3fb_) using a non-constant time nonce comparison for CSRF protection, enabling statistical analysis to potentially obtain a valid nonce. This is the root cause: a non-constant time comparis...

CVE-2023-41935

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

CVE-2023-41935

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

CVE-2023-41935

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

Huawei EulerOS: Security Advisory for libldb (EulerOS-SA-2023-2650)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...