eZ Platform Bundled jQuery affected by CVE-2019-11358

In eZ Platform 2.x, ezsystems/ezplatform-admin-ui-assets before v4.2.0 includes jQuery version 3.3.1. This version of jQuery is affected by the security vulnerability https://www.cvedetails.com/cve/CVE-2019-11358/ This is fixed in jQuery version 3.4. We recommend that you upgrade your...

Extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

An extension script is vulnerable if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or "". No bundled extension is vulnerable. Vulnerable uses do appear in a documentation example and in non-bundled extensions. Hence, the attack prerequisite is ...

Cisco IOS XE Software NETCONF/RESTCONF IPv4 Access Control List Bypass Vulnerability

A vulnerability in the data model interface DMI services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access resources that should have been protected by a configured IPv4 access control list ACL. This vulnerability is due to improper handling of error conditions wh...

SUSE: Security Advisory (SUSE-SU-2024:0075-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apple macOS Ventura Security Vulnerability

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura version 13.4, which stems from an application that may be able to inject code into sensitive binaries bundled with Xcode...

Vulnerabilities fixed in IBM DB2

IBM has fixed vulnerabilities in several DB2 products such as DB2, DB2 for Cloud Pak and Web Query for i. A malicious party could exploit the exploit the vulnerabilities to grant himself locally elevated privileges assigned arbitrary code and thus execute arbitrary code with potentially privilege...

postgresql: extension script @substitutions@ within quoting allow SQL injection

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or "". If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with...

Ovic Product Bundle <= 1.1.2 - Missing Authorization

Description The Ovic Product Bundle plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removebundleproduct function hooked via a nopriv AJAX action in versions up to, and including, 1.1.2. This makes it possible for unauthenticated...

SUSE-SU-2023:4496-1 Security update for libreoffice

This update for fixes the following issues: libreoffice was updated rom 7.5.4.1 to 7.6.2.1 jscPED-6799, jscPED-6800: - For the highlights of changes of version 7.6 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.6 - You can check for each minor releas...

jenkins -- HTTP/2 denial of service vulnerability in bundled Jetty

Jenkins Security Advisory: Description High SECURITY-3291 / CVE-2023-36478, CVE-2023-44487 HTTP/2 denial of service vulnerability in bundled Jetty...

GHSA-56PW-MPJ4-FXWW Duplicate Advisory: Bundled libwebp in Pillow vulnerable

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-56pw-mpj4-fxww. This link is maintained to preserve external references. Original Description Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 previously...

PYSEC-2023-183

opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2...

SUSE-FU-2023:3696-1 Feature update for LibreOffice

This update for LibreOffice fixes the following issues: libreoffice: - Version update from 7.3.6.2 to 7.5.4.1 jscPED-3561, jscPED-3550, jscPED-1785: For the highlights of changes of version 7.5 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.5 For the...

OPENSUSE-SU-2023:0247-1 Security update for chromium

This update for chromium fixes the following issues: - CVE-2023-4863: temporary build with the bundled library on Leap boo1215231...

CVE-2023-20191

A vulnerability in the access control list ACL processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incomplete support for this feature. An attacker could exploit th...

Vulnerability in core server (CVE-2023-39417)

Extension script @substitutions@ within quoting allow SQL injection An extension script is vulnerable if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or "". No bundled extension is vulnerable. Vulnerable uses do appear in a documentation examp...

MGASA-2023-0214 Updated perl-DBD-SQLite packages fix security vulnerability

Possible unfixed security issues due to bundled sqlite3...

Updated perl-DBD-SQLite packages fix security vulnerability

Possible unfixed security issues due to bundled sqlite3...

PT-2023-36346 · Sqlite3 · Sqlite3

Name of the Vulnerable Software and Affected Versions: sqlite3 affected versions not specified Description: The issue is related to possible unfixed security issues due to bundled sqlite3. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

Security vulnerability in product bundling feature

Description Our e-commerce platform offers a bundled sales promotion feature, allowing an administrator to bind the sale of a product to an addon. However, we have identified a security vulnerability that exists in this feature. After an administrator cancels a bundle offer, users can still make...