CVE-2023-32075 Pimcore vulnerable to Business Logic Errors in Customer automation rules

The Customer Management Framework CMF for Pimcore adds functionality for customer data management. In pimcore/customer-management-framework-bundle prior to version 3.3.9, business logic errors are possible in the Conditions tab since the counter can be a negative number. This vulnerability is...

CVE-2023-32075 Pimcore vulnerable to Business Logic Errors in Customer automation rules

The Customer Management Framework CMF for Pimcore adds functionality for customer data management. In pimcore/customer-management-framework-bundle prior to version 3.3.9, business logic errors are possible in the Conditions tab since the counter can be a negative number. This vulnerability is...

CVE-2023-32075

Summary of CVE-2023-32075: The Pimcore CMF’s customer-management-framework-bundle is affected in versions before 3.3.9. A business-logic flaw in the Conditions tab allows the counter value to become negative, leading to unlogic in the UI/logic. The issue is fixed in version 3.3.9; patch guidance ...

Windows OLE Code Execution

The vulnerability of the Windows OLE operating system is related to synchronization errors when using a shared resource. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Win32k.sys Privilege Escalation

The vulnerability of the Win32k.sys component in Windows operating systems is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

PT-2023-22194 · Vitess +2 · Vitess +2

Name of the Vulnerable Software and Affected Versions: Vitess versions prior to 16.0.2 Description: The issue allows users to create a shard containing / characters from VTAdmin, which can cause errors when trying to create new shards or view keyspaces. Creating a shard using vtctldclient does no...

L2ALM Component Junos OS DoS

The vulnerability of the L2ALM component Layer 2 Address Learning Manager in Juniper Networks’ Junos OS-based QFX series routers stems from the use of memory after it is freed due to synchronization errors when using shared resources. Exploiting this vulnerability can allow a malicious actor to...

Node.js: OpenSSL error handling issues in nodejs crypto library

A cryptographic vulnerability exists in Node.js 19.2.0, 18.14.1, 16.19.1, 14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread...

Moderate: Red Hat Security Advisory: Image Builder security, bug fix, and enhancement update

An update for cockpit-composer, osbuild, osbuild-composer, and weldr-client is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

PT-2023-2691 · Microsoft · Windows Graphics +1

Name of the Vulnerable Software and Affected Versions: Windows Graphics Component affected versions not specified Description: The issue is related to synchronization errors when using a shared resource in the Windows Graphics Component. This can allow an attacker to elevate their privileges. The...

Moderate: git-lfs security and bug fix update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705 golang:...

PT-2023-35817 · Git +1 · Harfbuzz

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN WRITE, with details provided in a crash state. The crash involves the...

Security Bulletin: Vulnerability in cURL libcurl affects IBM Process Mining . CVE-2023-23916

Summary There is a vulnerability in cURL libcurl that could allow a remote attacker to execute a denial of service on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2023-23916...

PT-2023-2785 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue is related to errors in security settings, allowing a remote attacker to bypass security restrictions. Recommendations: At the moment, there is no informatio...

Oracle Solaris Libraries Error

The vulnerability of the Oracle Solaris operating system’s Libraries component is related to errors in processing input data. Exploiting this vulnerability can allow a remote attacker to execute a DoS attack...

antivirus protection tools such

The vulnerability of antivirus protection tools such as Avast Antivirus, AVG Antivirus, and Avira Security for Windows operating systems is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to execute arbitrary files...

Illumina Universal Copy Service Disclosure Privilege Escalation

The vulnerability of microprogrammed medical devices with the Illumina Universal Copy Service is related to errors in privilege management. Exploiting this vulnerability can allow a malicious actor to disclose protected information, upload and execute code with elevated privileges...

TP-Link T2600G-28SQ Unauthorized Access

The vulnerability of TP-Link T2600G-28SQ switch’s microprogramming software is related to errors in managing registration data when processing SSH keys. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

OPC UA DoS

The vulnerability of the implementation of OPC UA software for connection integration with Softing OPC UA C++ SDK, the data integration tool Softing edgeAggregator, and the software modules for connecting controllers such as Softing edgeConnector Modbus, Softing edgeConnector 840D, and Softing...

Upgraded Q -> 3 from #13 [1683219131959]

Judge has assessed an item in Issue 13 as 3 risk. The relevant finding follows: L-6 Consider using OpenZeppelin’s SafeCast library to prevent unexpected errors 3 --- The text was updated successfully, but these errors were encountered: 👍 1 sathishpic22 reacted with thumbs up emoji All reactions 👍...