CVE-2023-5415

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaddcategory function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

Deposit into strategy could be blocked by limits in EigenLayer

Lines of code Vulnerability details Summary The implementation of depositAssetIntoStrategy deposits the entire balance of the node delegator which could conflict with the max limits per deposit defined in EigenLayer. Impact NodeDelegator are responsible for managing assets in EigenLayer. The...

The vulnerability of the web server of Delta Electronics’ DX-3021L9 microprogrammed router software arises from insufficient validation of input data. This allows attackers to add, modify, or delete data.

The vulnerability of the web server of the microprogrammed routing software from Delta Electronics DX-3021L9 exists due to insufficient verification of input data. Exploiting this vulnerability can allow a remote attacker to add, modify, or delete data...

kernel: scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix possible resource leaks in mpt3sastransportportadd In mpt3sastransportportadd, if sasrphyadd returns error, sasrphyfree needs be called to free the resource allocated in sasenddevicealloc. Otherwise a kernel...

kernel security, bug fix, and enhancement update

5.14.0-362.8.13.OL9 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

CVE-2023-45875

An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster...

kernel: cifs: Fix xid leak in cifs_ses_add_channel()

A transaction ID xid leak was found in the CIFS/SMB filesystem. When adding a new channel fails, the allocated xid is not freed, leading to gradual exhaustion of the xid pool...

kernel: scsi: scsi_transport_sas: Fix error handling in sas_phy_add()

In the Linux kernel, the following vulnerability has been resolved: scsi: scsitransportsas: Fix error handling in sasphyadd If transportadddevice fails in sasphyadd, the kernel will crash trying to delete the device in transportremovedevice called from sasremovehost. Unable to handle kernel NULL...

kernel: Linux kernel: Denial of Service due to incorrect FDIR filter fallback logic

A flaw was found in the Linux kernel. Incorrect fallback logic within the FDIR Flow Director filter handling of the 'ice' network driver can occur when adding a filter. A local attacker with low privileges could exploit this flaw, leading to a memory leak. This memory leak could eventually result...

Storefront Installation Error Adding Local Administrators to CitrixStorefrontAdministrators Group

Install StoreFront with below error: There was an error adding user accounts in the Administrators local group to the CitrixStorefrontAdministrators local group.See the log files described in the article 'Troubleshoot Storefront' in the Storefront product documentation. Try adding these user...

Logic flaw vulnerability in the electronic document security management system of Beijing Yisaitong Technology Development Co., Ltd (CNVD-2023-96198)

Beijing Yisetong Technology Development Co., Ltd. is a domestic data security, network security and security services provider of three major business. The electronic document security management system of Beijing Yisetong Technology Development Co., Ltd. has a logic flaw vulnerability, which can...

CVE-2023-46303

linktolocalpath in ebooks/conversion/plugins/htmlinput.py in calibre before 6.19.0 can, by default, add resources outside of the document root...

CVE-2023-43149

SPA-Cart 1.9.0.3 is vulnerable to Cross Site Request Forgery CSRF that allows a remote attacker to add an admin user with role status...

Workspace error "Unable to add account with the given server URL"

After adding Gateway URL on Windows Workspace, we can see below error: -------- Unable to add account with the given server URL. Ensure that it is correct or enter your email address --------...

PBM Error "Authentication failed: Invalid credentials" when adding machine to one catalog

When attempting to add machines to an existing catalog the process fails immediately with the below error, in Studio. "Machine Failures: domainname\machinename: Failed to create the virtual machine; domainname\machinename. Inner Error: A general system error occurred: PBM error occurred during...

SPA-Cart eCommerce CMS Cross-Site Request Forgery Vulnerability

SPA-Cart eCommerce CMS is a CMS system from SPA-Cart Inc. A security vulnerability exists in SPA-Cart eCommerce CMS version 1.9.0.3 that stems from the presence of a cross-site request forgery CSRF vulnerability. An attacker can exploit the vulnerability to add an administrator user with role...

CVE-2023-43149

CVE-2023-43149 affects SPA-Cart 1.9.0.3. The documents confirm a CSRF vulnerability enabling a remote attacker to add an admin user with role status. They do not provide concrete technical details (endpoints, payloads, root cause) or remediation within the supplied sources. No exploitation specif...

OroCommerce Cross-Site Scripting Vulnerability

OroCommerce is an open source business-to-business commerce application from Oro. A cross-site scripting vulnerability exists in OroCommerce versions 4.1.0 through 4.1.13, 4.2.0 through 4.2.10, 5.0.0 through 5.0.11, and 5.1.0 through 5.1.1, which stems from the possibility that the JS payload add...

Announcing the $12k NIST Elliptic Curves Seeds Bounty

The NIST elliptic curves that power much of modern cryptography were generated in the late '90s by hashing seeds provided by the NSA. How were the seeds generated? Rumor has it that they are in turn hashes of English sentences, but the person who picked them, Dr. Jerry Solinas, passed away in ear...

CVE-2023-41094

TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration This issue affects Ember ZNet 7.1.x from 7.1.3...