PT-2023-9392 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Xen versions affected versions not specified Linux kernel versions affected versions not specified Description: The issue is related to insufficient input validation in the libfsimage component of the Xen hypervisor and Linux kernel. This cou...

CVE-2023-44107

Vulnerability of defects introduced in the design process in the screen projection module.Successful exploitation of this vulnerability may affect service availability and integrity...

The vulnerability of the restoreSettings function in the Comments Like Dislike plugin of the WordPress content management system allows a hacker to compromise the integrity of the data.

The vulnerability of the restoreSettings function in the WordPress content management system’s comments and dislikes module is related to authentication errors. Exploiting this vulnerability could allow an attacker to compromise data integrity...

PT-2023-8947 · Mediawiki +2 · Wikibase Extension For Mediawiki +2

Name of the Vulnerable Software and Affected Versions: Wikibase extension for MediaWiki versions prior to 1.35.12 Wikibase extension for MediaWiki versions 1.36.x through 1.39.x before 1.39.5 Wikibase extension for MediaWiki versions 1.40.x before 1.40.1 Description: The issue is related to the...

Lack of validation allows invalid ticks, impacting data integrity.

Lines of code Vulnerability details Impact Function crossTicks updates the tick tracking data when ticks are crossed, but does not validate that exitTick and entryTick are valid and make sense. For example, exitTick could be lower than entryTick. Proof of Concept Here is the relevant code in the...

The vulnerability of the Watchkit application development framework of the HarmonyOS operating system, which allows a hacker to compromise data confidentiality and integrity.

The vulnerability of the Watchkit framework for application development in the HarmonyOS operating system is related to an incorrect restriction on the path name to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to compromise data confidentiality and...

The vulnerability of the Ad hoc Transfer Module of the WS_FTP Server allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Ad hoc Transfer Module of the WSFTP Server server is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability in the web interface of the Control Web Panel (CWP), previously known as CentOS Web Panel, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Control Web Panel formerly CentOS Web Panel web interface relates to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the GetParentControlInfo() function in Tenda AC10U router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the GetParentControlInfo function in Tenda AC10U router software lies in the issue of the operation going beyond the buffer in memory when processing the mac parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the tif_processing_dng_channel_count function in the ImageGear image processing library allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tifprocessingdngchannelcount function in the ImageGear image processing library relates to the issue of data being written outside of the buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

The vulnerability of the kernel of the EMUI operating system of HarmonyOS allows attackers to compromise data privacy and integrity.

The vulnerability of the EMUI operating system of HarmonyOS is related to authentication errors. Exploiting this vulnerability could allow a remote attacker to compromise data confidentiality and integrity...

The vulnerability of the delete.php script (located at general/hr/manage/staff_title_evaluation/delete.php) within the Tongda OA automation tool for business processes, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the delete.php script located at general/hr/manage/stafftitleevaluation/delete.php within the Tongda OA automation tool relates to the failure to protect the SQL query structure during the processing of the EVALUATIONID parameter. Exploiting this vulnerability allows an...

The vulnerability of the OpenDMARC authentication and email analysis software lies in its ability to bypass authentication through spamming, allowing attackers to compromise the integrity of data.

The vulnerability of the OpenDMARC authentication and email analysis software relates to the ability to bypass authentication through spamming. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

Producer Initiated Transactions in Spring Cloud Stream Kafka Applications

Other parts in this blog series Part 1: Introduction to Transactions in Spring Cloud Stream Kafka Applications This article is part 2 of the blog series in which we look at transactions in detail with Spring Cloud Stream and Apache Kafka. We saw a general introduction to transactions in the...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL11-2023-003)

The version of postgresql installed on the remote host is prior to 11.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL11-2023-003 advisory. A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let...

Introduction to Transactions in Spring Cloud Stream Kafka Applications

We are starting a new blog series that focuses on working with transactions in Spring Cloud Stream Kafka applications. This blog series covers many low-level details of writing transactional applications with Spring Cloud Stream and Apache Kafka. By the end of this blog series, we hope to give yo...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL12-2023-004)

The version of postgresql installed on the remote host is prior to 12.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL12-2023-004 advisory. A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let...

The vulnerability of the SetWifiDownSettings function in the D-Link DIR-823G router’s microprogramming software allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the SetWifiDownSettings function in the D-Link DIR-823G router’s microprogramming system is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

Medium: ruby

Issue Overview: A flaw was found in the way the Ruby REXML library parsed XML documents. Parsing a specially crafted XML document using REXML and writing parsed data back to a new XML document results in creating a document with a different structure. This issue could affect the integrity of...

The vulnerability of the arp_sys.asp component of D-Link DI-7200G V2 microprogramming router allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the arpsys.asp component of D-Link DI-7200G V2 microprogrammed router software is related to the execution of operations outside the buffer during the processing of the znjb parameter. Exploiting this vulnerability allows an attacker to compromise the confidentiality,...