PT-2023-18125 · Unknown · Package Manager

Name of the Vulnerable Software and Affected Versions: Package Manager affected versions not specified Description: The issue allows an attacker to determine whether an app is installed without query permissions, due to side channel information disclosure. This could lead to local information...

PT-2023-12218 · Isula · Isula

Name of the Vulnerable Software and Affected Versions: isula affected versions not specified Description: The issue arises when the isula cp command is used to copy files from a container to a host machine, and the container is controlled by an attacker. This allows the attacker to escape the...

PT-2023-8678

Name of the Vulnerable Software and Affected Versions GnuTLS affected versions not specified Description A vulnerability was found related to the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange, which differ from response times of ciphertexts with correct PKCS1 v1.5 padding...

PT-2023-29644

Name of the Vulnerable Software and Affected Versions stb vorbis affected versions not specified Description The issue is related to the processing of ogg vorbis files. A crafted file can trigger an out of bounds write in f-vendorlen = char'0';. This occurs when len read in start decoder is a...

PT-2023-36283 · Suse · Container-Suseconnect

Name of the Vulnerable Software and Affected Versions: container-suseconnect affected versions not specified Description: The issue is related to a security release in the go 1.21 package. The container-suseconnect package has been rebuilt with this security release to address the issue. There is...

PT-2023-36270 · Unknown · Kubernetes Containerd

Name of the Vulnerable Software and Affected Versions: containerd affected versions not specified Description: The issue is related to a security concern addressed by rebuilding the package with the go 1.21 security release. Recommendations: At the moment, there is no information about a newer...

CVE-2023-3042

In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes // from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edittextinc.jsp , which should return a 404 response b...

Design/Logic Flaw

In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes // from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edittextinc.jsp...

CVE-2023-3042 CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8

In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes // from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edittextinc.jsp , which should return a 404 response b...

CVE-2023-3042 CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8

In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes // from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edittextinc.jsp , which should return a 404 response b...

PT-2023-26863 · Sonicos · Sonicos

Name of the Vulnerable Software and Affected Versions: SonicOS affected versions not specified Description: The issue is a post-authentication Stack-Based Buffer Overflow vulnerability in the ssoStats-s.xml and ssoStats-s.wri URL endpoints, which can lead to a firewall crash. Recommendations: At...

PT-2023-6213 · South River Technologies · Titan Mft +1

Name of the Vulnerable Software and Affected Versions: South River Technologies' Titan MFT and Titan SFTP servers affected versions not specified Description: The issue is related to insufficient path validation when extracting a zip archive, allowing an authenticated attacker to write a file to...

PT-2023-6214 · South River Technologies · Titan Mft +1

Name of the Vulnerable Software and Affected Versions: South River Technologies' Titan MFT and Titan SFTP servers affected versions not specified Description: A session fixation issue allows an attacker to bypass server authentication by tricking an administrator into authorizing a session ID of...

SQL Injection

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to SQL Injection due to improper neutralization of special elements used in an SQL command. An attacker can execute arbitrary code by injecting SQL...

AZL-34889 CVE-2023-45142 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...

PT-2023-36275 · Conmon · Conmon

Name of the Vulnerable Software and Affected Versions: conmon affected versions not specified Description: The issue is related to conmon being rebuilt with go1.21. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world...

PT-2023-27575 · Unknown · Fw-Packagemanager

Name of the Vulnerable Software and Affected Versions: FW-PackageManager affected versions not specified Description: The issue is related to a possible missing permission check in FW-PackageManager. This could lead to local escalation of privilege, with System execution privileges needed...

PT-2023-27576 · Unknown · Fw-Packagemanager

Name of the Vulnerable Software and Affected Versions: FW-PackageManager affected versions not specified Description: The issue is related to a possible missing permission check in FW-PackageManager. This could lead to local escalation of privilege, with System execution privileges needed...

CVE-2023-44390

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either svg or math are in the list of allowed elements. In the case an application sanitizes us...

Important: curl

Issue Overview: HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1 NOTE: https://curl.se/docs/CVE-2023-38039.html NOTE: Introduced by: https://github.com/curl/curl/commit/7c8c723682d524ac9580b9ca3b71419163cb5660 curl-7830 NOTE: Experimental tag removed in:...