CVE-2023-32064 OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility

OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and...

WP User Frontend < 3.6.9 - Missing Authorization via AJAX actions

Description The WP User Frontend plugin for WordPress is vulnerable to unauthorized functionality use due to a missing capability check on several functions corresponding to AJAX actions in versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with...

WP User Frontend < 3.6.6 - Authenticated (Author+) Privilege Escalation

Description The WP User Frontend – Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission Plugin plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.5. This is due to the plugin not providing...

Malicious code in frontend-components-react-transpiled (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 463e9359f450d451e47eef2a46a82e6d6fe266ffa312c37239b9e2fda0a440fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8535 Malicious code in frontend-components-react-transpiled (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 463e9359f450d451e47eef2a46a82e6d6fe266ffa312c37239b9e2fda0a440fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ext-frontend-identity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 23a7d0539d44404b1c2e340d011eaa58dcad96a27d7d6aef90736d641da7ce39 The OpenSSF Package Analysis project identified 'ext-frontend-identity' @ 7.1.1-develop.9 npm as malicious. It is considered malicious because: ...

MAL-2023-8516 Malicious code in ext-frontend-identity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 23a7d0539d44404b1c2e340d011eaa58dcad96a27d7d6aef90736d641da7ce39 The OpenSSF Package Analysis project identified 'ext-frontend-identity' @ 7.1.1-develop.9 npm as malicious. It is considered malicious because: ...

Default credentials

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

TYPO3 vulnerable to Weak Authentication in Session Handling

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/E:X/RL:O/RC:C 4.0 Problem Given that there are at least two different sites in the same TYPO3 installation - for instance first.example.org and second.example.com - then a session cookie generated for the first site can be reused on the second si...

GHSA-3VMM-7H4J-69RM TYPO3 vulnerable to Weak Authentication in Session Handling

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/E:X/RL:O/RC:C 4.0 Problem Given that there are at least two different sites in the same TYPO3 installation - for instance first.example.org and second.example.com - then a session cookie generated for the first site can be reused on the second si...

squid: Request/Response smuggling in HTTP/1.1 and ICAP

SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems...

kernel: memory leak in ttusb_dec_exit_dvb() in media/usb/ttusb-dec/ttusb_dec.c

A memory leak issue was found in the Linux kernel media subsystem in the TTUSB DEC driver. It could occur in the ttusbdecexitdvb function because of the lack of a dvbfrontenddetach call. A local user could trigger this flaw by repeatedly plugging and unplugging the device, potentially causing a...

kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible

A potential deadlock flaw was found in the Linux’s kernel DVB API used by Digital TV devices functionality. This flaw allows a local user to crash the system...

MAL-2023-8514 Malicious code in frontend-style-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2950942ff85300d3cee0a0eed9f373eaaa043ef93e942089421c5a5586e209e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frontend-style-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2950942ff85300d3cee0a0eed9f373eaaa043ef93e942089421c5a5586e209e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ext-frontend-esignature (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dcffa9ade419d008513b815bd316ec2f2100a8a3510b692cb84a11ca2e5b2ac6 The OpenSSF Package Analysis project identified 'ext-frontend-esignature' @ 2.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2023-8513 Malicious code in ext-frontend-esignature (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dcffa9ade419d008513b815bd316ec2f2100a8a3510b692cb84a11ca2e5b2ac6 The OpenSSF Package Analysis project identified 'ext-frontend-esignature' @ 2.0.1 npm as malicious. It is considered malicious because: - The...

PT-2023-30330 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 8.7.55 TYPO3 versions prior to 9.5.44 TYPO3 versions prior to 10.4.41 TYPO3 versions prior to 11.5.33 TYPO3 versions prior to 12.4.8 Description: The issue affects TYPO3 installations with at least two different sites,...

TYPO3 8.0.0 < 8.7.55 ELTS / 9.0.0 < 9.5.44 ELTS / 10.0.0 < 10.4.41 ELTS / 11.0.0 < 11.5.33 / 12.0.0 < 12.4.8 (TYPO3-CORE-SA-2023-006)

The version of TYPO3 installed on the remote host is prior to 8.0.0 8.7.55 ELTS / 9.0.0 9.5.44 ELTS / 10.0.0 10.4.41 ELTS / 11.0.0 11.5.33 / 12.0.0 12.4.8. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2023-006 advisory. - Given that there are at least two...

RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2023:6980)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6980 advisory. Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contai...