CVE-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

SUSE-SU-2023:2476-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: - CVE-2023-21930: Fixed possible compromise from unauthenticated attacker with network access via TLS bsc1210628. - CVE-2023-21937: Fixed vulnerability inside the networking component bsc1210631. - CVE-2023-21938: Fixed vulnerability inside...

cvc-components.com Cross Site Scripting vulnerability OBB-3401534

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Ubuntu 20.04 LTS / 22.04 LTS : LibreOffice vulnerabilities (USN-6144-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6144-1 advisory. It was discovered that LibreOffice did not properly validate the number of parameters passed to the formula interpreter, leading to an array...

CVE-2023-29727

The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related to user privacy settings and affects the implementation of the normal functionality of the application. An attacker can use this to cause...

CVE-2023-29727

The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related to user privacy settings and affects the implementation of the normal functionality of the application. An attacker can use this to cause...

Alarm Clock security vulnerability

Alarm Clock is an app from the Smart Alarm Clock Team team. It is used to set the hours and minutes of an online alarm clock. A security vulnerability exists in Alarm Clock for Heavy Sleepers version v.5.3.2, which stems from allowing unauthorized applications to cause privilege escalation via...

@devlego/builder (>=1.1.29-alpha.1, <=1.1.34), @metro-fs/analytics-plugin-posthog (>=1.0.0, <=1.6.0) +6 more potentially affected by CVE-2023-32325 via posthog-js (>=1.4.5, <=1.53.2)

posthog-js NPM version =1.4.5, =1.1.29-alpha.1, =1.0.0, =2.1.0, =2.0.5, =1.3.39, =3.28.0-rc.1, =1.16.0, =1.16.1 Source cves: CVE-2023-32325 Source advisory: MEND:CVE-2023-32325...

CVE-2023-2255

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would lo...

CVE-2023-33246

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-2780 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-2780 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-2780 Source advisory: OSV:PYSEC-2023-69...

org.opencms:opencms-components (9.5.0), org.opencms:opencms-gwt (9.5.0) +19 more potentially affected by CVE-2023-31544 via org.opencms:opencms-core (9.5.0)

org.opencms:opencms-core MAVEN version 9.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-components 9.5.0 - org.opencms:opencms-gwt 9.5.0 - org.opencms:opencms-setup 9.5.0 -...

org.opencms:opencms-components (9.5.3), org.opencms:opencms-gwt (9.5.3) +19 more potentially affected by CVE-2023-31544 via org.opencms:opencms-core (9.5.3)

org.opencms:opencms-core MAVEN version 9.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-components 9.5.3 - org.opencms:opencms-gwt 9.5.3 - org.opencms:opencms-setup 9.5.3 -...

org.opencms:opencms-components (9.0.1), org.opencms:opencms-gwt (9.0.1) +19 more potentially affected by CVE-2023-31544 via org.opencms:opencms-core (9.0.1)

org.opencms:opencms-core MAVEN version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - org.opencms:opencms-components 9.0.1 - org.opencms:opencms-gwt 9.0.1 - org.opencms:opencms-setup 9.0.1 -...

CVE-2022-47392

An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition...

Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to cross-site scripting (CVE-2022-0225)

Summary IBM i Modernization Engine for Lifecycle Integration platform component is vulnerable to cross-site scripting as described in the Vulnerability Details section. These components are used in IBM i Modernization Engine for Lifecycle Integration for infrastructure support in the platform. IB...

org.xwiki.rendering:xwiki-rendering-macro-html (7.1-rc-1), org.xwiki.rendering:xwiki-rendering-standalone (7.1-rc-1) +7 more potentially affected by CVE-2023-32070 +1 more via org.xwiki.rendering:xwiki-rendering-syntax-xhtml (7.1-rc-1)

org.xwiki.rendering:xwiki-rendering-syntax-xhtml MAVEN version 7.1-rc-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.xwiki.rendering:xwiki-rendering-syntax-xhtml and may be impacted: - org.xwiki.rendering:xwiki-rendering-macro-html 7.1-rc-1 -...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-30172 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-30172 Source advisory: OSV:GHSA-WC6J-5G83-XFM6...

Trucking on with DotDumper

Trucking on with DotDumper By Trellix · May 11, 2023 This blog was written by Max Kersten On the 11th of August 2022, the initial public version of DotDumper was released. A brief refresh: DotDumper is an open-source automatic unpacker for DotNet Framework targeting files. This blog marks a publi...