Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-132)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-132 advisory. It has been discovered that on some AMD CPUs, the RAS Return Address Stack, also called RAP - Return Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-054)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-054 advisory. AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2023-031)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-031 advisory. NSS Network Security Services up to and including 3.73 is vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within...

CVE-2023-22680

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Altanic No API Amazon Affiliate plugin = 4.2.2 versions...

CVE-2023-22680

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Altanic No API Amazon Affiliate plugin = 4.2.2 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Altanic No API Amazon Affiliate plugin = 4.2.2 versions...

CVE-2023-22680 WordPress No API Amazon Affiliate Plugin <= 4.2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Altanic No API Amazon Affiliate plugin = 4.2.2 versions...

CVE-2023-22680

CVE-2023-22680 affects the WordPress plugin No API Amazon Affiliate (Altanic No API Amazon Affiliate) 4.2.2 (4.4.0) with low severity. No public exploit details are provided in the connected documents. Remediation: upgrade to a version greater than 4.2.2 (e.g., 4.4.0+). If upgrading is not feasib...

CVE-2023-22680 WordPress No API Amazon Affiliate Plugin <= 4.2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Altanic No API Amazon Affiliate plugin = 4.2.2 versions...

PT-2023-18625 · Altanic · Altanic No Api Amazon Affiliate Plugin

Name of the Vulnerable Software and Affected Versions: Altanic No API Amazon Affiliate plugin versions = 4.2.2 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scripts into the...

WordPress Amazon S3 Plugin < 1.6 - Reflected XSS

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress Amazon S3 Plugin < 1.6 - Reflected XSS

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC...

WordPress Plugin No API Amazon Affiliate 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

Threat Source newsletter (March 16, 2023) — A deep dive into Talos' work in Ukraine

Welcome to this weeks edition of the Threat Source newsletter. Were written a ton about Cisco Talos support of Ukraine and our friends and allies there. Now, we encourage you to watch and listen to the folks who have been working hands-on there. The latest episode of ThreatWise TV from Hazel Burt...

ALPHV ransomware gang claims it has hacked Amazon’s Ring

By Deeba Ahmed ALPHV ransomware group threatens to leak sensitive data allegedly stolen from amazon's ring security cameras unless demands are met. This is a post from HackRead.com Read the original post: ALPHV ransomware gang claims it has hacked Amazons Ring...

OpenSearch has issue with fine-grained access control of indices backing data streams

Impact There is an issue with the implementation of fine-grained access control rules document-level security, field-level security and field masking where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. This issue can on...

OpenSearch has time discrepancy in authentication responses

Impact There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider IdP, and not other externally configured IdPs. Patches OpenSearch 1.3.9...

GHSA-C6WG-CM5X-RQVJ OpenSearch has time discrepancy in authentication responses

Impact There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider IdP, and not other externally configured IdPs. Patches OpenSearch 1.3.9...

The vulnerability in applications for creating reports using TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS arises due to an incorrect path name limitation in the restricted directory. This allows attackers to disclose sensitive information.

The vulnerability of applications for generating reports with TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS exists due to ...

Amazon Linux 2 : libdb (ALAS-2023-1965)

The version of libdb installed on the remote host is prior to 5.3.21-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1965 advisory. Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges ...