CVE-2023-46846

SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems...

[SECURITY] Fedora 38 Update: attract-mode-2.7.0-5.fc38

Attract-Mode is a graphical frontend for command line emulators such as MAME, MESS, and Nestopia. It hides the underlying operating system and is intended to be controlled with a joystick, gamepad or spin dial, making it ideal for use in arcade cabinet setups...

[SECURITY] Fedora 37 Update: attract-mode-2.6.2-6.fc37

Attract-Mode is a graphical frontend for command line emulators such as MAME, MESS, and Nestopia. It hides the underlying operating system and is intended to be controlled with a joystick, gamepad or spin dial, making it ideal for use in arcade cabinet setups...

Fedora: Security Advisory for attract-mode (FEDORA-2023-1242b3ada2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

squid: Request/Response smuggling in HTTP/1.1 and ICAP

SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems...

admin-tool-button (>=1.0.1a0 <=1.0.5a0), aedttest (=0.0.2) +125 more potentially affected by CVE-2023-46695 via django (>=3.2.0 <=3.2.22)

django PYPI version =3.2.0, =1.0.1a0, =2.0.0, =0.0.1, =1.0.6, =3.2.17.0, =6.2.0, =0.2.0, =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev13, =22.0.0.dev14 and more Source cves: CVE-2023-46695 Source advisory: OSV:GHSA-QMF9-6JQF-J8FQ...

RHEL 9 : squid (RHSA-2023:6266)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6266 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: SQUID-2023:...

MAL-2023-8408 Malicious code in kraken-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 541643c0665be0f6a95d3fcf36b66a5207c0689803fd75c891032af3a8c2c9a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kraken-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 541643c0665be0f6a95d3fcf36b66a5207c0689803fd75c891032af3a8c2c9a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fadam-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 02e81c60df4cba570ba561c45c4e1f48fe798f16078ef1a7c2c601cdb3edf1f7 The OpenSSF Package Analysis project identified 'fadam-frontend' @ 101.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8406 Malicious code in fadam-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 02e81c60df4cba570ba561c45c4e1f48fe798f16078ef1a7c2c601cdb3edf1f7 The OpenSSF Package Analysis project identified 'fadam-frontend' @ 101.0.0 npm as malicious. It is considered malicious because: - The package...

Code injection

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

Cross site scripting

Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected authcallback=1, which is leveraged by the WebSocket authentication logic in tandem with the state parameter. The state parameter contains the hassUrl, which is...

CVE-2023-41896 Fake websocket server installation permits full takeover in Home Assistant Core

Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected authcallback=1, which is leveraged by the WebSocket authentication logic in tandem with the state parameter. The state parameter contains the hassUrl, which is...

PT-2023-7041

Name of the Vulnerable Software and Affected Versions Squid affected versions not specified Description The issue is related to the chunked decoder of the Squid proxy server, which is associated with the server's interpretation of fragmented syntax encoding. This can allow a remote attacker to...

Ninja Forms < 3.6.34 - Admin+ Stored XSS

Description The plugin does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfilteredhtml capability can perform this, and such users are already allowed to use JS in posts/comments etc however the...

[SECURITY] Fedora 38 Update: cacti-1.2.25-1.fc38

Cacti is a complete frontend to RRDTool. It stores all of the necessary information to create graphs and populate them with data in a MySQL database. The frontend is completely PHP driven...

[SECURITY] Fedora 37 Update: cacti-1.2.25-1.fc37

Cacti is a complete frontend to RRDTool. It stores all of the necessary information to create graphs and populate them with data in a MySQL database. The frontend is completely PHP driven...