PT-2023-26098 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC version 2.3-DEV-rev381-g817a848f6-master Description: A segmentation violation was discovered in the gf isom remove user data function at /lib/libgpac.so. This issue affects the specified version of GPAC. Recommendations: For GPAC versio...

PT-2023-26099 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC version 2.3-DEV-rev381-g817a848f6-master Description: A segmentation violation was discovered in the BM ParseIndexValueReplace function at /lib/libgpac.so. This issue affects the GPAC library. Recommendations: For GPAC version...

New Mozilla Feature Blocks Risky Add-Ons on Specific Websites to Safeguard User Security

Mozilla has announced that some add-ons may be blocked from running on certain sites as part of a new feature called Quarantined Domains. "We have introduced a new back-end feature to only allow some extensions monitored by Mozilla to run on specific websites for various reasons, including securi...

New Mozilla Feature Blocks Risky Add-Ons on Specific Websites to Safeguard User Security

Mozilla has announced that some add-ons may be blocked from running on certain sites as part of a new feature called Quarantined Domains. "We have introduced a new back-end feature to only allow some extensions monitored by Mozilla to run on specific websites for various reasons, including securi...

Explanation about 'nshttpd' internal services up on ports 80.

After a recent upgrade from 13.0 build 90.11 to 13.1 build 48.47, I noticed a new internal service was installed. "set service nshttpd-gui-x.x.x.x -80 -cip ENABLED" Is this a necessary service and what is it's purpose? If it's not needed, I'd like to disable since it's using port 80...

PT-2023-5384 · D Link · D-Link Dwl-6610Ap

Name of the Vulnerable Software and Affected Versions: D-LINK DWL-6610 version FW v 4.3.0.8B003C Description: The issue is related to a command injection vulnerability in the sub 2EF50 function. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter...

PT-2023-10353 · Dynacase · Dynacase Webdesk

Name of the Vulnerable Software and Affected Versions: Dynacase Webdesk versions prior to 3.2-20180305 Description: A critical issue was found in Dynacase Webdesk, affecting the freedomrss search function of the freedomrss search.php file. This issue leads to sql injection. Recommendations: Upgra...

PT-2023-25743 · Unknown · Phpgurukul Online Security Guards Hiring System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Security Guards Hiring System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted payload to the "search booking box" API endpoint. This is a Cross-Site Scripting XSS issue, which mean...

PT-2023-33044 · Unknown · Sweetalert2

Name of the Vulnerable Software and Affected Versions: sweetalert2 versions 11.6.14 and above Description: The sweetalert2 package exhibits potentially undesirable behavior by outputting audio and/or video messages unrelated to its functionality when run on specific top-level domains TLDs. This...

PT-2023-25419 · Kodbox · Kodbox

Name of the Vulnerable Software and Affected Versions: kodbox version 1.26 Description: A critical issue affects the function Execute of the file webconsole.php.txt in the WebConsole Plug-In component, leading to os command injection. The exploit has been disclosed publicly and may be used. The...

PT-2023-6404 · Nextcloud +1 · Nextcloud Calendar +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Calendar app versions prior to 4.4.4 Description: The issue is related to missing precondition checks in the Nextcloud calendar app, which causes the server to attempt validation of strings of any length as email addresses. This can...

PT-2023-25224 · Gz Scripts · Gz Forum Script

Name of the Vulnerable Software and Affected Versions: GZ Scripts GZ Forum Script version 1.8 Description: A vulnerability was found in the file /preview.php, where the manipulation of the arguments catid, topicid, topic, topic message, or free name leads to cross site scripting. The attack may b...

PT-2023-5224 · Ibm · Ibm Db2 Jdbc Driver

Name of the Vulnerable Software and Affected Versions: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows versions 10.5, 11.1, and 11.5 Description: The issue is related to an unchecked logger injection in the IBM Db2 JDBC Driver, which could allow a remote authenticated attacker to execute...

PT-2023-25213 · Unknown · Simplephpscripts Newsletter Script

Name of the Vulnerable Software and Affected Versions: SimplePHPscripts NewsLetter Script PHP version 2.4 Description: A problematic issue was found in the URL Parameter Handler component, specifically in the /preview.php file, allowing for cross site scripting. The attack can be launched remotel...

PT-2023-25205 · Unknown · Sourcecodester Shopping Website

Name of the Vulnerable Software and Affected Versions: SourceCodester Shopping Website version 1.0 Description: A critical issue has been found, affecting an unknown function of the file check availability.php. The manipulation of the email argument leads to sql injection, allowing for remote...

How to use the CLI to disable HTTP OPTIONS Method for virtual server

Some security scanning reports suggest to disable the OPTIONS HTTP Method on web server. The article provides the use of a rewrite policy to avoid processing the OPTIONS HTTP Method...

GHSA-JQHC-M2J3-FJRX SQLFluff users with access to config file, using `libary_path` may call arbitrary python code

Impact In environments where untrusted users have access to the config files e.g. .sqlfluff, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. Jinja macros are executed within a sandboxed...

DEBIAN-CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

PYSEC-2023-111

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

PYSEC-2023-111

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...