Security Bulletin: IBM Storage Fusion HCI could be vulnerable to code injection via use of quartz/quartz-jobs [CVE-2023-39017]

Summary The Java library quartz/quartz-jobs is used by IBM Storage Fusion HCI for backup scheduling. A vulnerability in this library includes code injection that could lead to execution of arbitrary code as described in the CVE listed in the 'Vulnerabilities Details' section. This bulletin...

CVE-2023-52310

PaddlePaddle before 2.6.0 has a command injection in getonlinepassinterval. This resulted in the ability to execute arbitrary commands on the operating system...

CVE-2023-52310

PaddlePaddle before 2.6.0 has a command injection in getonlinepassinterval. This resulted in the ability to execute arbitrary commands on the operating system...

Tiny Technologies TinyMCE Cross-Site Scripting Vulnerability

Tiny Technologies TinyMCE is a rich text editor from Tiny Technologies, USA. A cross-site scripting vulnerability exists in Tiny Technologies TinyMCE prior to version 5.9.0, which originates from an authenticated, remote attacker who can insert crafted HTML into the editor, resulting in the...

Ubuntu: Security Advisory (USN-6563-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated. A security vulnerability exists in Qualcomm Chipsets that originates from a memory corruption when running the NPU when both NETWORKUNLOAD and NETWORKUNLOAD or NETWORKEXECUTEV2 commands are submitted...

Vulnerability of the web interface of the operating system PAN-OS, allowing a perpetrator to execute arbitrary code

The vulnerability of the PAN-OS operating system’s web interface is related to the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with limited privileges on the firewall...

CVE-2020-26623

SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under the AdministrationWidget tab after the login portal...

Apache DolphinScheduler: Arbitrary js execute as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue...

CVE-2023-49299 Apache DolphinScheduler: Arbitrary js execute as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue...

DEBIAN-CVE-2023-50572

An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM OutofMemory error...

AZL-66918 CVE-2023-50572 affecting package jline 2.14.6-1

An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM OutofMemory error...

UBUNTU-CVE-2023-50572

An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM OutofMemory error...

PT-2023-31595 · Unknown +1 · Jline-Groovy +1

Name of the Vulnerable Software and Affected Versions: jline-groovy version 3.24.1 Description: An issue in the component GroovyEngine.execute of jline-groovy allows attackers to cause an out of memory OOM error. Recommendations: For version 3.24.1, consider disabling the GroovyEngine.execute...

JLine Security Vulnerability

JLine is a Java library for processing console input from the JLine open source. A security vulnerability exists in JLine version v3.24.1, which stems from a security issue in the component GroovyEngine.execute that results in out of memory...

Cloudflare Wrangle Security Breach

Cloudflare Wrangler is a repository from Cloudflare, Inc. A security vulnerability exists in Cloudflare Wrangler versions prior to 3.19.0 that stems from the presence of an arbitrary code execution vulnerability that allows an attacker on a local network to connect to the inspector and run...

openSUSE 15 Security Update : zabbix (openSUSE-SU-2023:0419-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0419-1 advisory. - An attacker who has the privilege to configure Zabbix items can use function icmpping with additional malicious command inside it to execute arbitrary...

CVE-2023-49469

Reflected Cross Site Scripting XSS vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag function...

CVE-2023-43481

Affected software: Shenzhen TCL Browser TV Web BrowseHere (com.tcl.browser) v6.65.022_dab24cc6_231221_gp. Vulnerable component: com.tcl.browser.portal.browse.activity.BrowsePageActivity. Root cause/impact: remote attacker can execute arbitrary JavaScript code, enabling full control over the affec...

TCL BrowseHere Security Breach

Tcl Communication TCL BrowseHere is a video playback browser with a sophisticated interface from TCL Communication China. A security vulnerability exists in TCL BrowseHere version 6.65.022dab24cc6231221gp, which originates from a vulnerability that allows remote attackers to execute arbitrary...