CVE-2023-38759

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

Tenable Nessus < 10.5.4 Multiple Vulnerabilities (TNS-2023-27)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.5.4. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-27 advisory. - Nessus leverages third-party software to help provide underlying functionality...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-4033 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-4033 Source advisory: OSV:GHSA-FFW3-6378-CQGP...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-4033 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-4033 Source advisory: OSV:PYSEC-2023-280...

Oracle Hyperion Workspace Unauthorized Access

The vulnerability of the UI and visualization components of the Oracle Hyperion Workspace reporting application relates to insecure management of privileges. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information, to modify, add, or delete data,...

PT-2023-36237 · Unknown · Cdi-Uploadserver-Container +7

Name of the Vulnerable Software and Affected Versions: containerized-data-importer affected versions not specified cdi-apiserver-container affected versions not specified cdi-cloner-container affected versions not specified cdi-controller-container affected versions not specified...

MAL-2023-8008 Malicious code in @rocketrefer/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0c06dd93e949e2750017a45685b6d200640e259c416cb4cbc995550ea3e04ab0 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Security Bulletin: IBM Cognos Analytics is affected but not classified as vulnerable to multiple vulnerabilities

Summary IBM Cognos Analytics is affected but not classified as vulnerable to vulnerabilities, based on current information, in the following 3rd-party components: Stanford coreNLP, FasterXML jackson-databind, SnakeYAML, Dromera Hutool, jsoup, Node.js vm2 and Node.js http-cache-semantics. These...

Zoom Improper Cryptographic Signature Downgrade

The vulnerability of Zoom’s video conferencing software is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow an attacker to downgrade the versions of Zoom components to earlier versions...

org.apache.jackrabbit:jackrabbit-standalone-components (>=2.21.0, <=2.21.17) potentially affected by CVE-2023-37895 via org.apache.jackrabbit:jackrabbit-webapp (>=2.21.0, <=2.21.17)

org.apache.jackrabbit:jackrabbit-webapp MAVEN version =2.21.0, =2.21.0, =2.21.17 Source cves: CVE-2023-37895 Source advisory: OSV:GHSA-Q8CM-3V62-JJ79...

org.apache.jackrabbit:jackrabbit-standalone-components (>=2.21.0, <=2.21.17) potentially affected by CVE-2023-37895 via org.apache.jackrabbit:jackrabbit-webapp (>=2.21.0, <=2.21.17)

org.apache.jackrabbit:jackrabbit-webapp MAVEN version =2.21.0, =2.21.0, =2.21.17 Source cves: CVE-2023-37895 Source advisory: GHSA-Q8CM-3V62-JJ79...

org.apache.jackrabbit:jackrabbit-standalone-components (>=2.21.0, <=2.21.17) potentially affected by CVE-2023-37895 via org.apache.jackrabbit:jackrabbit-webapp (>=2.21.0, <=2.21.17)

org.apache.jackrabbit:jackrabbit-webapp MAVEN version =2.21.0, =2.21.0, =2.21.17 Source cves: CVE-2023-37895 Source advisory: MEND:CVE-2023-37895...

Medium: icu

Issue Overview: International Components for Unicode ICU-20850 v66.1 was discovered to contain a use after free bug in the pkgcreateWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp. CVE-2020-21913 Affected Packages: icu Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Medium: libicu60

Issue Overview: International Components for Unicode ICU-20850 v66.1 was discovered to contain a use after free bug in the pkgcreateWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp. CVE-2020-21913 Affected Packages: libicu60 Note: This advisory is applicable to Amazon Linux 2 AL2...

PT-2023-5289 · Apple +6 · Apple Macos +6

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.5 WebKitGTK affected versions not specified WPE WebKit affected versions not specified Description: The issue is related to errors in handling input data during code syntax analysis, which may allow a remote...

APIkit HTTP Connector OAuth2 Provider Unauthorized Access

The vulnerabilities of the APIkit components, the HTTP connector, and the OAuth2 Provider integrated into the API Gateway environment of Mule Runtime Mule are related to errors in processing the relative path to the restricted directory. Exploiting these vulnerabilities can allow an attacker to...

Global CDN Service ‘jsdelivr’ Exposed Users to Phishing Attacks

By Habiba Rashid In the interconnected world of web development, open-source components play a vital role, facilitating collaboration and code sharing… This is a post from HackRead.com Read the original post: Global CDN Service jsdelivr Exposed Users to Phishing Attacks...

org.opencms:opencms-components (9.5.0), org.opencms:opencms-gwt (9.5.0) +19 more potentially affected by CVE-2023-37602 via org.opencms:opencms-core (9.5.0)

org.opencms:opencms-core MAVEN version 9.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-components 9.5.0 - org.opencms:opencms-gwt 9.5.0 - org.opencms:opencms-setup 9.5.0 -...

org.opencms:opencms-components (9.5.3), org.opencms:opencms-gwt (9.5.3) +19 more potentially affected by CVE-2023-37602 via org.opencms:opencms-core (9.5.3)

org.opencms:opencms-core MAVEN version 9.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-components 9.5.3 - org.opencms:opencms-gwt 9.5.3 - org.opencms:opencms-setup 9.5.3 -...

Cisco BroadWorks security vulnerabilities

Cisco BroadWorks is a carrier-grade unified communications software platform from Cisco. It is used to deploy cloud calls from public network platforms on any type of wired or wireless network architecture. A security vulnerability exists in Cisco BroadWorks that stems from a flaw in the privileg...