Advisory ROSA-SA-2023-2232

Software: firefox 102.14.0 OS: rosa-server79 packageevrstring: firefox-102.14.0-3.res7.x8664.rpm CVE-ID: CVE-2023-3417 BDU-ID: 2023-03965 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Thunderbird email client exists due to improper handling of the Unicode character for overriding text directio...

CVE-2023-40725

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application returns inconsistent error messages in response to invalid user credentials during login session. This allows an attacker to enumerate usernames, and identify valid usernames...

PT-2023-5131 · Microsoft · Windows Mshtml Platform +2

Name of the Vulnerable Software and Affected Versions: Windows MSHTML Platform affected versions not specified Description: The issue is related to errors in security settings, allowing an attacker to bypass existing security restrictions. This can enable attackers to affect the system. There is ...

glibc Resource Management Error Vulnerability

glibc GNU C Library is a C standard library implemented by a GNU project of the GNU community. A resource management error vulnerability exists in glibc, which stems from the fact that the gaihinet function may use freed memory, causing the application to crash...

PT-2023-5058 · Microsoft · Office

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Description: The issue is related to errors in the representation of information by the user interface in Microsoft Office. It allows a remote attacker to conduct spoofing attacks...

The vulnerability of the Mutt mail client, related to errors in pointer aliasing, allows a hacker to trigger a service failure.

The vulnerability of the Mutt mail client is related to errors in pointer manipulation when processing message headers. Exploiting this vulnerability can allow an attacker to cause a service failure...

In transferFrom() address "from" can be put of contract address and bypass Errors.FromNotCreateOfferer(from)

Lines of code Vulnerability details Impact In transferFrom address "from" can be put of contract address and bypass Errors.FromNotCreateOffererfrom Proof of Concept the code should be function transferFromaddress from, address targetTokenReceiver, uint256 createOrderHashAsTokenId external...

The vulnerability of the Python programming language’s cryptography interpreter lies in errors in the certificate validation process, which allows attackers to execute a type of “man-in-the-middle” attack.

The vulnerability of the Python programming language’s cryptography interpreter is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...

ROS-20230907-02

Vulnerability in the Core component of Oracle VM VirtualBox virtual machine is related to resource release errors resources. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary code or gain full control of an application using the RDP protocol. arbitrary code or...

The vulnerability of the local management platform FortiSwitchManager, related to errors in access control, allows a attacker to modify settings by sending commands through the application programming interface.

The vulnerability of the FortiSwitchManager local management platform is related to errors in access control. Exploiting this vulnerability allows a malicious actor to make changes to settings by sending commands through the application programming interface...

The vulnerability of the Bouncy Castle cryptographic protection mechanism lies in errors during the certificate validation process, which allows attackers to disclose the protected information.

The vulnerability of the Bouncy Castle cryptographic protection mechanism is related to errors in the certificate validation process. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the protected information...

The vulnerability of the SEL-5037 SEL Grid Configurator software in terms of creating, managing, and deploying energy systems allows a perpetrator to execute arbitrary code with administrative privileges. This vulnerability is related to errors in privilege management.

The vulnerability of the SEL-5037 SEL Grid Configurator software in terms of creating, managing, and deploying energy systems is related to errors in privilege management. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code with administrative privileges...

The vulnerability of the iperf function in the set_iperf3_svr.cgi application programming interface of ASUS RT-AX55, RT-AX56U, and RT-AC86U routers allows a hacker to execute arbitrary code.

The vulnerability of the iperf function in the application programming interface for ASUS RT-AX55, RT-AX56UV2, and RT-AC86U routers is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the microprogrammed Ethernet switch software from RUGGEDCOM ROS allows a hacker to send arbitrary packets into the mirrored network.

The vulnerability of the microprogrammed Ethernet switch software from RUGGEDCOM ROS is related to errors in representing certain functions. Exploiting this vulnerability allows a remote attacker to send arbitrary packets to the mirrored network...

The vulnerability of the XWiki platform for creating collaborative web applications lies in authentication errors, which allow a malicious user to execute arbitrary web scripts with elevated privileges.

The vulnerability of the XWiki Platform lies in authentication errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary web scripts with elevated privileges...

The vulnerability of Google Chrome’s BFCache component, which allows attackers to perform spoofing attacks

The vulnerability of Google Chrome’s BFCache component is related to information representation errors in the user interface. Exploiting this vulnerability allows a remote attacker to perform spoofing attacks using a specially created HTML page...

The vulnerability of the YARN NodeManager component in Apache Hadoop’s distributed development and execution platform allows a hacker to gain unauthorized access to arbitrary passwords.

The vulnerability of the YARN NodeManager component in Apache Hadoop distributed development and execution platforms is related to registration data management errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to arbitrary passwords...

Absence of Start-End Time Validation in Range Creation

Lines of code Vulnerability details The code allows the creation of a Range structure without ensuring that startTime is strictly less than endTime. The absence of this validation might lead to unintended behavior or logical errors in functionalities that rely on the order of these timestamps...

Design/Logic Flaw

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0...

Out-Of-Bounds Read

libfreerdp.so is vulnerable to Out-Of-Bound Read. The vulnerability exists because of the lack of boundary checks in the multiopaquerect-numRectangles of orders.c, which leads to out-of-bounds read errors, allowing an attacker to cause an application crash...