CVE-2023-28111: Server-Side Request Forgery (SSRF)

Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, attackers are able to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the...

PT-2023-20443 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 3.1.0.beta2 through 3.1.0.beta3 Description: Discourse is an open-source discussion platform. Editing or responding to a chat message containing malicious content could lead to a cross-site scripting attack. Recommendations...

CVE-2023-23622: Exposure of Sensitive Information to an Unauthorized Actor

Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, the count of topics displayed for a tag is a count of all regular topics regardless of whether the topic is in a read restricted category or...

CVE-2023-23935: Exposure of Sensitive Information to an Unauthorized Actor

Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the stable branch and versions 3.1.0.beta2 and prior on the beta and tests-passed branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal...

MAL-2023-247 Malicious code in devcenter-internal-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98f2a9462d907363d8ee0b60751517a45053b2025cbb04e3d7e7b3001c306657 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in devcenter-internal-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98f2a9462d907363d8ee0b60751517a45053b2025cbb04e3d7e7b3001c306657 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 38 Update: neatvnc-0.6.0-2.fc38

This is a liberally licensed VNC server library that's intended to be fast and neat. Note: This is a beta release, so the interface is not yet stable...

GHSA-C5VJ-F36Q-P9VG Password Shucking Vulnerability

Impact An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible. If an attacker gets 1 the user's hashed...

Authorization

CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability...

CVE-2023-27580: Use of Password Hash With Insufficient Computational Effort

CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability...

Intel® Media Server Studio for Windows* Vulnerability Advisory

Summary: A potential security vulnerability in the Intel® Media Server Studio may allow for the escalation of privilege. Intel is releasing Media Server Studio updates and providing the instructions below to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2018-3697...

CVE-2023-25819 Discourse tags with no visibility are leaking into og:article:tag

Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the tests-passed or beta branches = 3.1.0.beta2. The issue is patched in the latest beta and tests-passed version of Discourse...

CVE-2023-25819: Exposure of Private Personal Information to an Unauthorized Actor

Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the tests-passed or beta branches = 3.1.0.beta2. The issue is patched in the latest beta and tests-passed version of Discourse...

PT-2023-20324 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 3.1.0.beta2 through the version prior to the latest beta and tests-passed versions Description: The issue concerns the exposure of private tags in metadata on Discourse, an open-source platform for community discussions. Th...

Gmail and Google Calendar Now Support Client-Side Encryption (CSE) to Boost Data Privacy

Google has announced the general availability of client-side encryption CSE for Gmail and Calendar, months after piloting the feature in late 2022. The data privacy controls enable "even more organizations to become arbiters of their own data and the sole party deciding who has access to it,"...

What’s New for Developers: February 2023

Read about the most recent updates to EdgeWorkers, two new Postman collections, and Terraform Provider v3.3.0 — and find out how to sign up for betas...

Google Rolling Out Privacy Sandbox Beta on Android 13 Devices

Google announced on Tuesday that it's officially rolling out Privacy Sandbox on Android in beta to eligible mobile devices running Android 13. "The Privacy Sandbox Beta provides new APIs that are designed with privacy at the core, and don't use identifiers that can track your activity across apps...

Google Rolling Out Privacy Sandbox Beta on Android 13 Devices

Google announced on Tuesday that it's officially rolling out Privacy Sandbox on Android in beta to eligible mobile devices running Android 13. "The Privacy Sandbox Beta provides new APIs that are designed with privacy at the core, and don't use identifiers that can track your activity across apps...

SUSE CVE-2007-2583

The indecimal::set function in itemcmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-dependent attackers to cause a denial of service crash via a crafted IF clause that results in a divide-by-zero error and a NULL pointer dereference...

SUSE CVE-2010-3399

The jsInitRandom function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11, 3.6.4 through 3.6.8, and 4.0 Beta1 uses a context pointer in conjunction with its successor pointer for seeding of a random number generator, which makes it easier for remote attackers to guess th...