Vulnerabilities fixed in Ivanti Secure Access Client

Ivanti has fixed vulnerabilities in Secure Access Client formerly Pulse Secure Desktop Client. A local malicious person could exploit the vulnerabilities to grant himself elevated privileges granted and thus execute code with potentially system privileges and/or gain access to sensitive data...

U.S. Dept Of Defense: Unauthenticated File Read Adobe ColdFusion

A vulnerability allowing unauthenticated arbitrary file read in Adobe ColdFusion was discovered. This could result in unauthorized access to sensitive data on affected systems. The vulnerability impacts ColdFusion versions 2021 Update 5 and earlier, and 2018 Update 15 and earlier. Mitigation is t...

The vulnerability of the Mdadm RAID management tool, related to copying buffers without checking input data, allows a hacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the RAID array management tool Mdadm lies in the copying of buffers without checking the input data. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause service failures...

The vulnerability of Google Chrome’s browser extensions allows a perpetrator to access sensitive data, compromise its integrity, and cause service interruptions.

The vulnerability of Google Chrome’s browser Extensions relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause service interruptions through a specially created HTML page...

The vulnerability of the get_register function in the Vim text editor allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the getregister function in the Vim text editor is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause service failures...

The vulnerability of the Libxml2 library, related to the lack of measures taken to protect the structure of web pages, allows attackers to access confidential data and compromise its integrity.

The vulnerability of the Libxml2 library is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity...

The vulnerability of the replication function of Docker, a tool for automating the deployment and management of applications in containerized environments, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the replication function of Docker’s containerization and application deployment/management tools is related to improper storage of permissions. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the automation tool for deploying and managing applications in Docker-enabled environments, related to improper permission storage, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the automation tool for deploying and managing applications in Docker-enabled environments is related to improper storage of permissions. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the NILFS file system driver in Linux operating systems allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the NILFS file system driver in Linux operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the readimg function in the OpenImageIO image processing library allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the readimg function in the OpenImageIO image processing library is related to the copying of buffers without checking the input data. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and even cause service failures...

The vulnerability of NVIDIA Virtual GPU driver involves an uncontrolled search path element, which allows attackers to gain unauthorized access to protected information, enhance their privileges, execute arbitrary code, or cause service failures.

The vulnerability of NVIDIA Virtual GPU driver is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information, increase their privileges, execute arbitrary code, or cause service failures...

The vulnerability of the LZ4 data compression algorithm, which allows unauthorized access to confidential data by writing beyond the buffer boundaries, thereby enabling attackers to compromise the integrity of sensitive information and cause service interruptions.

The vulnerability of the lossless LZ4 data compression algorithm is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause service interruptions...

The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules, related to the lack of protective measures for web page structures, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

SUSE CVE-2023-5868

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes,...

XML Eexternal Entity (XXE) Injection

tuxguitar is vulnerable to XML Eexternal Entity XXE Injection. An attacker is able to exploit a flaw in the way that TuxGuitar parses XML files to load GP6 and GP7 tablature files. The attacker can then trick a user into opening a specially crafted GP6 or GP7 file, which would cause TuxGuitar to...

Vulnerabilities fixed in PostgreSQL

Vulnerabilities have been fixed in PostgreSQL. A malicious person could exploit the vulnerabilities to gain access to system data, cause a denial-of-service, or to execute arbitrary code with application privileges. The vulnerabilities have also been fixed in PostgreSQL 11 11.22. This are, howeve...

The vulnerability of the graphical interface of the IBM Navigator operating system, IBM i, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the IBM Navigator graphical interface of the IBM i operating system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information...

Code injection

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to get...

CVE-2023-47615

A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to get access to a...

CVE-2023-47114 Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their personal data. If the...