Endpoint Security 8.4.1 Security Update

Elastic Endpoint Security Local Privilege Escalation issue ESA-2022-14 An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account. Affected Versions: Version 8.4.0...

kernel: iavf: Fix reset error handling

A deadlock condition exists in the linux kernel such that when calling iavfclose in iavfresettask error handling,doing so can lead to double call of napidisable thereby leading to a denial of service due to the deadlock...

PT-2023-19398 · Trendnet · Trendnet Wireless Ac Easy-Upgrader Tew-820Ap

Name of the Vulnerable Software and Affected Versions: TrendNet Wireless AC Easy-Upgrader TEW-820AP version 1.0R, firmware version 1.01.B01 Description: A stack overflow vulnerability was discovered in the submit-url parameter at the "/formSystemCheck" API endpoint. This issue allows attackers to...

CakePHP vulnerable to Denial of Service attack through XML payloads

RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages Xml::build which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML...

GHSA-Q79M-C546-2G63 CakePHP vulnerable to Denial of Service attack through XML payloads

RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages Xml::build which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML...

PT-2023-1551 · Unknown +2 · Html-Stripscripts +2

Name of the Vulnerable Software and Affected Versions: HTML-StripScripts versions 1.06 and earlier Description: The issue is related to the hss attval style function in the HTML-StripScripts module, which allows ReDoS Regular expression Denial of Service due to catastrophic backtracking when...

PT-2023-18857 · Gpac · Gpac

Name of the Vulnerable Software and Affected Versions: GPAC version 2.2-rev0-gab012bbfb-master Description: A memory leak was discovered in the lsr read rare full function. Recommendations: For GPAC version 2.2-rev0-gab012bbfb-master, consider disabling the lsr read rare full function as a...

PT-2023-15903 · Mycms · Mycms

Name of the Vulnerable Software and Affected Versions: MyCMS affected versions not specified Description: A problematic issue was found in MyCMS, affecting the build view function of the file lib/gener/view.php in the Visitors Module. The manipulation of the original/converted argument leads to...

PT-2023-9883 · Ruby · Jruby-Openssl

Name of the Vulnerable Software and Affected Versions: jruby-openssl gem versions prior to 0.6 Description: A security issue was found in the handling of SSL certificate validation, where failed verification did not properly alert the application, making it vulnerable to attacks. This could allow...

PT-2023-15479 · Popojicms · Popojicms

Name of the Vulnerable Software and Affected Versions: PopojiCMS version 2.0.1 Description: The issue concerns a file upload vulnerability in the backend plugin function. Recommendations: For PopojiCMS version 2.0.1, consider disabling the file upload functionality in the backend plugin as a...

Git Users Urged to Update Software to Prevent Remote Code Execution Attacks

The maintainers of the Git source code version control system have released updates to remediate two critical vulnerabilities that could be exploited by a malicious actor to achieve remote code execution. The flaws, tracked as CVE-2022-23521 and CVE-2022-41903, impacts the following versions of...

PT-2023-10247 · Danynab · Movify-J

Name of the Vulnerable Software and Affected Versions: danynab movify-j affected versions not specified Description: A critical vulnerability was found in danynab movify-j, affecting the function getByMovieId of the file app/business/impl/ReviewServiceImpl.java. The manipulation of the argument...

AZL-13026 CVE-2022-41903 affecting package git for versions less than 2.33.8-2

Git is distributed revision control system. git log can display commits in an arbitrary format using its --format specifiers. This functionality is also exposed to git archive via the export-subst gitattribute. When processing the padding operators, there is a integer overflow in...

CVE-2023-22734

Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. As a result operators may have inconsistencies in their newsletter systems. This...

CVE-2023-22733

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issu...

GSD-2023-1001264 ext4: disable fast-commit of encrypted dir operations

ext4: disable fast-commit of encrypted dir operations This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001023 media: imx-jpeg: Disable useless interrupt to avoid kernel panic

media: imx-jpeg: Disable useless interrupt to avoid kernel panic This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1000544 drm/amd/display: Fix DTBCLK disable requests and SRC_SEL programming

drm/amd/display: Fix DTBCLK disable requests and SRCSEL programming This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000070 drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame

drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.12 by commit...

PT-2023-33500 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.19 Description: The issue is related to a use-after-free error in the qlcnic dcb enable function. This error occurs when the qlcnic dcb enable function fails, potentially leading to a security issue. The...