Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Inability of Followers and Followees to Commenting

Lines of code Vulnerability details Impact The lack of functionality restricts interaction and engagement between the profile owner and their followers or the users they follow. This limitation diminishes the platform's value, as users who are interested in a post or have a genuine reason to...

Updated Researcher Portal Submission Form: Discover the New Fields in the Submission Form

Summary: We are excited to announce the release of the updated Researcher Portal submission form. These new fields allow Security Researchers to provide additional context for the reported security issue, providing product teams with more data for analysis, gain insights and identify trends acros...

CVE-2023-3343 User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection

The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input from the 'profile-pic-url' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP...

Out-of-bounds

In DMPixelLoggerProcessDmCommand of DMPixelLogger.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

DRUPAL-CONTRIB-2023-030

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. The module doesn't sufficiently ensure all core login routes, including the password reset page, require a second factor credential. This vulnerability is mitigated ...

CVE-2023-33901

In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-33902

In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-33890

In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-33880

In music service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-30931

In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-30918

In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

Information disclosure

In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-33901

In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-30941

In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-30917

In DMService, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges...

CVE-2023-29406

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

squidex 安全漏洞

squidex is a Headless CMS and Content Management Center. A security vulnerability exists in squidex versions prior to 7.4.0 that stems from improper handling of additional special elements...

CVE-2023-3580: Improper Handling of Additional Special Element

Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0...

[SECURITY] Fedora 38 Update: yt-dlp-2023.07.06-1.fc38

yt-dlp is a command-line program to download videos from many different online video platforms, such as youtube.com. The project is a fork of youtube-dl with additional features and fixes...