Cross site scripting

Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

gstreamer: MXF demuxer use-after-free vulnerability

A use-after-free flaw was found in the MXF demuxer in GStreamer when handling certain MXF video files. This issue could allow a malicious third party to trigger a crash in the application and may allow code execution...

Vulnerabilities fixed in Adobe Illustrator

Adobe has fixed vulnerabilities in Illustrator. A malicious party could exploit the vulnerabilities to execute arbitrary code execute arbitrary code. It is possible that code execution could occur with privileges higher than user level. For successful exploitation, the malicious party must trick...

Vulnerabilities fixed in Adobe After Effects

Adobe has fixed vulnerabilities in After Effects. A malicious party could exploit the vulnerabilities to gain access to system data, or to execute arbitrary code with privileges of the victim. The malicious party does not need any prior authorizations required. Adobe has released updates to fix t...

PT-2023-8710 · Zyxel · Zyxel Atp Series +3

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 Zyxel USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 Zyxel USG FLEX 50W series firmware versions from 4.16 through 5.37 Patch 1 Zyxel USG20W-VPN series firmwa...

PYSEC-2023-262

main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution...

PT-2023-8050 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.2 Description: The issue is related to a buffer overflow in the AppleGraphicsControl component of the macOS operating system. It may allow an attacker to execute arbitrary code using a specially crafted file. The...

SUSE-SU-2023:4665-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode to 20231030 bsc1215831: - CVE-2022-23820: Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution. - CVE-2021-46774: Insufficient...

SUSE-SU-2023:4664-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode to 20231030 bsc1215831: - CVE-2022-23820: Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution. - CVE-2021-46774: Insufficient...

SUSE-SU-2023:4655-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode to 20231030 bsc1215831: - CVE-2022-23820: Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution. - CVE-2021-46774: Insufficient...

OESA-2023-1866 stb security update

Single-file public domain libraries for C/C++. Security Fixes: stbimage is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in stbigifloadnext. This happens because twoback points to a memory address lower than the start of the...

VulnCheck KEV: CVE-2021-33564

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features...

USN-6517-1 perl vulnerabilities

It was discovered that Perl incorrectly handled printing certain warning messages. An attacker could possibly use this issue to cause Perl to consume resources, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS. CVE-2022-48522 Nathan Mills discovered that Perl incorrectly...

PT-2023-7260 · Adobe · Media Encoder

Name of the Vulnerable Software and Affected Versions: Adobe Media Encoder versions 24.0.2 and earlier Adobe Media Encoder versions 23.6 and earlier Description: The issue is related to an out-of-bounds read vulnerability in Adobe Media Encoder when parsing a crafted file. This could result in...

VulnCheck KEV: CVE-2022-3980

An XML External Entity XEE vulnerability allows server-side request forgery SSRF and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4...

CVE-2023-26456

Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code...

Mozilla: Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4

The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run...

PT-2023-26946 · Ashlar Vellum · Ashlar-Vellum Cobalt +4

Name of the Vulnerable Software and Affected Versions: Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share version 12 SP0 Build 1204.77 Description: The affected applications lack proper validation of user-supplied data when parsing XE files, which could lead to an out-of-bounds write. ...

PT-2023-20744 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application version 3.1.013 Description: The issue allows authenticated attackers to upload arbitrary files to the web root, including dangerous files such as ASP or ASPX, which can lead to command execution on the affected server...

PT-2023-6858 · Atlassian · Sourcetree

Name of the Vulnerable Software and Affected Versions: SourceTree affected versions not specified Description: The issue is related to insufficient input validation in the visual Git client SourceTree. Exploitation of this issue may allow an attacker to execute arbitrary code. Recommendations: At...