CVE-2023-31416

Secret token configuration is never applied when using ECK =8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment...

AZL-34692 CVE-2023-46752 affecting package frr for versions less than 9.1-2

An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MPREACHNLRI data, leading to a crash...

AZL-42751 CVE-2023-5363 affecting package cloud-hypervisor-cvm for versions less than 38.0.72.2-1

Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...

AZL-31686 CVE-2023-4692 affecting package grub2 for versions less than 2.06-13

An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a...

AZL-35141 CVE-2023-46136 affecting package python-werkzeug for versions less than 3.0.1-1

Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing...

UBUNTU-CVE-2023-5724

Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability affects Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.1...

UBUNTU-CVE-2023-5728

During garbage collection extra operations were performed on a object that should not be. This could have led to a potentially exploitable crash. This vulnerability affects Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.1...

UBUNTU-CVE-2023-5721

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This vulnerability affects Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.1...

UBUNTU-CVE-2023-5723

An attacker with temporary script access to a site could have set a cookie containing invalid characters using document.cookie that could have led to unknown errors. This vulnerability affects Firefox 119...

PT-2023-29787 · Unknown · I-Doit Pro

Name of the Vulnerable Software and Affected Versions: i-doit pro versions 25 and below Description: The issue is related to Cross Site Scripting XSS and can be exploited via the index.php endpoint. This allows for potential malicious script injection. Recommendations: For versions 25 and below,...

AZL-31653 CVE-2023-45145 affecting package redis for versions less than 6.2.14-1

Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, another process...

AZL-31288 CVE-2023-38545 affecting package curl for versions less than 8.3.0-2

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host na...

AZL-34612 CVE-2023-38545 affecting package cmake for versions less than 3.21.4-10

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host na...

AZL-31501 CVE-2023-38545 affecting package cmake for versions less than 3.21.4-10

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host na...

AZL-37886 CVE-2023-38545 affecting package tensorflow for versions less than 2.16.1-1

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host na...

AZL-31574 CVE-2023-22114 affecting package mysql for versions less than 8.0.35-1

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

AZL-35785 CVE-2023-45803 affecting package python-pip for versions less than 24.2-1

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...

AZL-31615 CVE-2023-45803 affecting package python-urllib3 for versions less than 1.26.18-1

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...

PT-2023-29347 · Unknown · Byconsole Wooodt Lite

Name of the Vulnerable Software and Affected Versions: ByConsole WooODT Lite – WooCommerce Order Delivery or Pickup with Date Time Location plugin versions = 2.4.6 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicio...

AZL-31567 CVE-2023-45871 affecting package kernel for versions less than 5.15.135.1-2

An issue was discovered in drivers/net/ethernet/intel/igb/igbmain.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU...