GSD-2023-1001804 btrfs: fix race between quota rescan and disable leading to NULL pointer deref

btrfs: fix race between quota rescan and disable leading to NULL pointer deref This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.230 by commi...

GSD-2023-1001672 btrfs: fix race between quota rescan and disable leading to NULL pointer deref

btrfs: fix race between quota rescan and disable leading to NULL pointer deref This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.8 by commit...

PT-2023-1267 · Dompdf +1 · Dompdf +1

Name of the Vulnerable Software and Affected Versions: Dompdf version 2.0.1 Dompdf versions prior to 8.0.0 Description: The issue is related to the incorrect order of authorization checks before syntax analysis and canonization when processing tags with uppercase letters in SVG parsing. This can...

PT-2023-19450 · Dromara · Dromara Hutool

Name of the Vulnerable Software and Affected Versions: Dromara Hutool version 5.8.11 Description: A deserialization issue allows an attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter. This enables the attacker to potentially gain control over the system. Recommendation...

PT-2023-15547 · Unknown · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey version 5.4.15 Description: A stored cross-site scripting XSS issue was discovered in the component "/index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts". This issue allows attackers to execute arbitrary web...

PT-2023-14420 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS version 7.64 Description: The issue is related to improper authentication. The application checks for a valid session when a user is not attempting to log in. A static secret in the generatePublicHash function allows an attacker...

PT-2023-16334 · Unknown · Sourcecodester Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Tours & Travels Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown part of the file admin/abc.php. The manipulation of the id argument leads to SQL injection. I...

github.com/openshift/apiserver-library-go Improper Input Validation vulnerability

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context...

UBUNTU-CVE-2023-22500

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by...

PT-2023-13954 · Siretta · Siretta Quartz-Gold

Name of the Vulnerable Software and Affected Versions: Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 Description: Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality. A specially-crafted network packet can lead to arbitrary command...

PT-2023-13933 · Siretta · Siretta Quartz-Gold

Name of the Vulnerable Software and Affected Versions: Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 Description: Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality. A specially-crafted network packet can lead to arbitrary command...

PT-2023-13909 · Siretta · Siretta Quartz-Gold

Name of the Vulnerable Software and Affected Versions: Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 Description: Several stack-based buffer overflow issues exist in the DetranCLI command parsing functionality. A specially-crafted network packet can lead to arbitrary command execution. An...

PT-2023-1300 · Vim +6 · Vim +6

Name of the Vulnerable Software and Affected Versions: vim versions prior to 9.0.1247 Description: The issue is related to a Divide By Zero error in the vim text editor, specifically associated with the smoothscroll function when the window size is small. This could potentially allow an attacker ...

systemd security update

250-12.0.2.el91.1 - Backport upstream pstore dmesg fix Orabug: 34868110 - Remove upstream references Orabug: 33995357 - Disable unprivileged BPF by default Orabug: 32870980 - udev rules: fix memory hot add and remove Orabug: 31310273 - set 'RemoveIPC=no' in logind.conf as default for OL7.2 Orabug...

PT-2023-12672 · Smartctl · Smartctl

Name of the Vulnerable Software and Affected Versions: smartctl versions all Description: The issue is related to Command Injection via the info method due to improper input sanitization. This allows for potential exploitation. No information is provided about the estimated number of potentially...

PT-2023-15153 · Small Crm · Small Crm

Name of the Vulnerable Software and Affected Versions: Small CRM version 3.0 Description: A cross-site scripting XSS issue in the Create Ticket page allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject parameter. This enables attackers to...

PT-2023-12833 · Unknown · Create-Choo-Electron

Name of the Vulnerable Software and Affected Versions: create-choo-electron versions all Description: The issue arises from improper user-input sanitization, making all versions of the package susceptible to Command Injection via the devInstall function. Recommendations: For all versions, conside...

PT-2023-19617 · Jenkins · Jenkins Keycloak Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Keycloak Authentication Plugin versions 2.3.0 and earlier Description: A cross-site request forgery CSRF issue allows attackers to trick users into logging in to the attacker's account. This can be achieved by exploiting the login...

PT-2023-19592 · Macstadium +1 · Jenkins Orka By Macstadium Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Orka by MacStadium Plugin versions 1.31 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs, potentially capturing...

PT-2023-12788 · Puppet · Puppet-Facter

Name of the Vulnerable Software and Affected Versions: puppet-facter versions all Description: The issue is related to Command Injection via the getFact function due to improper input sanitization. This allows for potential exploitation. No information is provided about the estimated number of...