DEBIAN-CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

UBUNTU-CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

PT-2023-28743 · Xnsoft · Xnsoft Nconvert

Name of the Vulnerable Software and Affected Versions: XNSoft Nconvert version 7.136 Description: The issue is related to a Buffer Overflow, which can be triggered by a crafted image file, leading to a User Mode Write AV. This could result in a Denial of Service DoS or potentially allow code...

GHSA-GGR8-3HWX-4F2M Magento Open Source allows SQL Injection

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could lead in arbitrary code execution by an admin-privileg...

PT-2025-16123 · Apple +5 · Ios +10

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17 iPadOS versions prior to 17 macOS Sonoma versions prior to 14 watchOS versions prior to 10 tvOS versions prior to 17 Safari versions prior to 17 Description: A use-after-free issue was addressed with improved memory...

PT-2023-28906 · Cachet +1 · Cachet +1

Name of the Vulnerable Software and Affected Versions: Cachet versions prior to 2.4 Description: A template functionality in Cachet allows users to create templates, which can lead to the execution of any code on the server due to bad filtration and an old twig version. This issue can be exploite...

CVE-2023-44086

A vulnerability has been identified in Tecnomatix Plant Simulation V2201 All versions V2201.0009, Tecnomatix Plant Simulation V2302 All versions V2302.0003. The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. Th...

AZL-31097 CVE-2023-41175 affecting package libtiff for versions less than 4.6.0-1

A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow...

PT-2023-6496 · Dell · Dell Smartfabric Storage

Name of the Vulnerable Software and Affected Versions: Dell SmartFabric Storage Software versions 1.4 and earlier Description: The issue is related to an OS Command Injection Vulnerability in the CLI of the Dell SmartFabric Storage Software. This vulnerability could allow an authenticated local...

Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs are present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these cou...

CVE-2023-5176

Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 118, Firefox ESR...

CVE-2023-4504 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023...

PT-2023-7547 · Qnap · Qts

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 4.2.6 build 20230621 QTS versions prior to 4.3.3.2420 build 20230621 QTS versions prior to 4.3.4.2451 build 20230621 QTS versions prior to 4.3.6.2441 build 20230621 Description: The issue is related to a buffer copy...

GHSA-55WP-3PQ4-W8P9 Jenkins temporary plugin file created with insecure permissions

Jenkins creates a temporary file when a plugin is deployed directly from a URL. Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates this temporary file in the system temporary directory with the default permissions for newly created files. If these permissions are overly permissive, they m...

Temporary plugin file created with insecure permissions

Jenkins creates a temporary file when a plugin is deployed directly from a URL. Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates this temporary file in the system temporary directory with the default permissions for newly created files. If these permissions are overly permissive, they m...

PT-2023-5880 · Omron · Omron Sysmac Studio

Name of the Vulnerable Software and Affected Versions: Omron Sysmac Studio affected versions not specified Description: The issue is related to poor permissions in a directory where executables are installed, allowing a locally-authenticated attacker to overwrite files. This can result in code...

PT-2023-20142 · Nvidia · Nvidia Dgx H100 Bmc

Name of the Vulnerable Software and Affected Versions: NVIDIA DGX H100 BMC affected versions not specified Description: The issue is related to insufficient protection of credentials in IPMI, which could lead to code execution, denial of service, information disclosure, and escalation of...

GHSA-5XMP-7WG5-X68Q Magento Open Source affected by Improper Input Validation

Adobe Commerce versions 2.4.3-p1 and earlier and 2.3.7-p2 and earlier are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution...

CVE-2023-41033

A vulnerability has been identified in Parasolid V35.0 All versions V35.0.260, Parasolid V35.1 All versions V35.1.246, Parasolid V36.0 All versions V36.0.156, Simcenter Femap V2301 All versions V2301.0003, Simcenter Femap V2306 All versions V2306.0001. The affected application contains an out of...

PT-2023-7036

Name of the Vulnerable Software and Affected Versions Electron versions prior to 26.0.0-beta.13 Electron versions prior to 25.5.0 Electron versions prior to 24.7.1 Electron versions prior to 23.3.13 Electron versions prior to 22.3.19 Description The issue is related to improper code generation...