OpenAM vulnerable to user impersonation using SAMLv1.x SSO process

Impact OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the...

PT-2023-26244 · Unknown · Easyadmin8

Name of the Vulnerable Software and Affected Versions: EasyAdmin8 version 2.0.2.2 Description: A vulnerability has been found in the File Upload Module of EasyAdmin8, affecting an unknown function of the file /admin/index/index.html/admin/mall.goods/index.html. This issue leads to unrestricted...

webkit2gtk3 security update

2.38.5-1.5 - Disable JIT CVE-2023-32435, CVE-2023-32439...

DEBIAN-CVE-2023-37276

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

UBUNTU-CVE-2023-37276

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only...

SUSE CVE-2023-37259

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting XSS. Since the Export Chat feature...

PT-2023-3892 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 12.1.1.15289 Foxit PDF Editor affected versions not specified Description: A use-after-free issue exists in the JavaScript engine, allowing an attacker to execute arbitrary code by manipulating form fields of a specif...

PT-2023-7026 · Unknown · Intergard Sgs

Name of the Vulnerable Software and Affected Versions: Intergard SGS version 8.7.0 Description: A vulnerability was found in the Password Change Handler component, leading to cleartext transmission of sensitive information. The attack can be launched remotely, with a rather high complexity and...

Samba Spotlight mdssvc RPC Request Infinite

Description When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function slunpackloop did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in ...

PT-2023-3717 · Google +1 · Google Chrome +1

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 115.0.5790.98 Description: The issue is related to an inappropriate implementation in the Autofill function of Google Chrome, which may allow a remote attacker to obfuscate security UI via a crafted HTML page...

PT-2023-25799 · Microsoft · Chakracore

Name of the Vulnerable Software and Affected Versions: ChakraCore version cbb9b Description: A stack overflow issue was discovered in ChakraCore via the Js::ScopeSlots::IsDebuggerScopeSlotArray function. Recommendations: For ChakraCore version cbb9b, as a temporary workaround, consider disabling...

WordPress WP Disable Sitemap Plugin <= 1.1.6.4 is vulnerable to Cross Site Scripting (XSS)

Software WP Disable Sitemap Type Plugin Vulnerable versions = 1.1.6.4 Fixed in 1.1.6.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ee9a57bb1bb5 Credits Rafie Muhammad Patchstack...

PT-2023-12541 · What3Words · What3Words Autosuggest Plugin

Name of the Vulnerable Software and Affected Versions: what3words Autosuggest Plugin versions up to 4.0.0 Description: A vulnerability has been found in the what3words Autosuggest Plugin, classified as problematic. The issue affects the enqueue scripts function of the file...

PT-2023-25728 · Unknown · Bylancer Quickai Openai

Name of the Vulnerable Software and Affected Versions: Bylancer QuickAI OpenAI version 3.8.1 Description: A critical issue affects the GET Parameter Handler component, specifically the file /blog, where manipulation of the s argument leads to sql injection. This issue can be initiated remotely. T...

PT-2023-25741 · Sourcecodester · Sourcecodester Insurance Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Life Insurance Management System version 1.0 Description: A critical vulnerability was found in the SourceCodester Life Insurance Management System. This issue affects the file login.php and is caused by the manipulation of the...

PT-2023-25626 · Sourcecodester · Sourcecodester Ac Repair/Services System

Name of the Vulnerable Software and Affected Versions: SourceCodester AC Repair and Services System version 1.0 Description: A vulnerability has been found in the system, classified as problematic. It affects an unknown functionality of the file "admin/?page=user/manage user". The manipulation of...

PT-2023-24339 · WordPress · User Registration

Name of the Vulnerable Software and Affected Versions: User Registration plugin for WordPress versions up to, and including, 3.0.2 Description: The issue arises from a hardcoded encryption key and missing file type validation on the ur upload profile pic function. This allows authenticated...

PT-2023-8134 · Microsoft · Office Word +8

Name of the Vulnerable Software and Affected Versions: Microsoft Office versions prior to the January 9, 2024 security update Office 2019 Office 2021 Office LTSC for Mac 2021 Microsoft 365 Description: A security issue exists in FBX that could lead to remote code execution. The vulnerability is...

PT-2023-25900 · Kofax · Kofax Power Pdf

Name of the Vulnerable Software and Affected Versions: Kofax Power PDF affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a maliciou...

PT-2023-3881 · Honeywell · Honeywell Experion Plantcruise +2

Name of the Vulnerable Software and Affected Versions: Honeywell Experion PKS versions affected versions not specified Honeywell Experion LX versions affected versions not specified Honeywell Experion PlantCruise versions affected versions not specified Description: The issue is related to a buff...