Microsoft Azure Services Flaws Could've Exposed Cloud Resources to Unauthorized Access

Four different Microsoft Azure services have been found vulnerable to server-side request forgery SSRF attacks that could be exploited to gain unauthorized access to cloud resources. The security issues, which were discovered by Orca between October 8, 2022 and December 2, 2022 in Azure API...

Microsoft Azure Services Flaws Could've Exposed Cloud Resources to Unauthorized Access

Four different Microsoft Azure services have been found vulnerable to server-side request forgery SSRF attacks that could be exploited to gain unauthorized access to cloud resources. The security issues, which were discovered by Orca between October 8, 2022 and December 2, 2022 in Azure API...

PT-2023-33499 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.18 Description: The issue concerns the pci device is present function, specifically with Virtual Functions VFs by checking the Physical Function PF. The actual impact and attack plausibility have not yet be...

PT-2023-34333 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.163 Description: The issue concerns the pci device is present function, specifically in relation to Virtual Functions VFs and their parent Physical Functions PFs. The problem is addressed by checking the P...

PT-2023-33968 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.87 Description: The issue is related to the pci device is present function, specifically with Virtual Functions VFs by checking the Physical Function PF. The actual impact and attack plausibility have not...

CVE-2022-44617

A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library...

PT-2023-33497 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.19 Description: A potential memory leak issue was identified in the vdpasim net init and vdpasim blk init functions. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

Shopware 代码注入漏洞

Shopware is a suite of open source e-commerce software from the German company Shopware. A code injection vulnerability exists in Shopware, which stems from the addition of the without the Sandbox extension environment variable to the Twig environment, which can be used to refer to PHP functions ...

PT-2023-10817 · Bigtree · Events Extension

Name of the Vulnerable Software and Affected Versions: Events Extension on BigTree affected versions not specified Description: A critical issue was found in the Events Extension, affecting the getRandomFeaturedEventByDate, getUpcomingFeaturedEventsInCategoriesWithSubcategories, recacheEvent, and...

CVE-2022-4060: Undefined Security Weakness

The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it...

Sql injection

A vulnerability, which was classified as critical, has been found in bony2023 Discussion-Board. Affected by this issue is the function displayallreplies of the file functions/main.php. The manipulation of the argument str leads to sql injection. The patch is identified as...

CVE-2015-10051

A vulnerability, which was classified as critical, has been found in bony2023 Discussion-Board. Affected by this issue is the function displayallreplies of the file functions/main.php. The manipulation of the argument str leads to sql injection. The patch is identified as...

PT-2023-10230 · Unknown · Bony2023 Discussion-Board

Name of the Vulnerable Software and Affected Versions: bony2023 Discussion-Board affected versions not specified Description: A critical issue has been found in the bony2023 Discussion-Board, affecting the display all replies function of the file functions/main.php. The manipulation of the str...

CVE-2015-10051: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, has been found in bony2023 Discussion-Board. Affected by this issue is the function displayallreplies of the file functions/main.php. The manipulation of the argument str leads to sql injection. The patch is identified as...

PT-2023-35917 · Git +1 · Libplist

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is reported, with a crash type indicating a Heap-buffer-overflow READ 1. The crash state involves functions such as par...

git2 Rust package suppresses ssh host key checking

By default, when accessing an ssh repository ie via an ssh: git repository url the git2 Rust package does not do any host key checking. Additionally, the provided API is not sufficient for a an application to do meaningful checking itself. Impact When connecting to an ssh repository, and when an...

ChatGPT-Written Malware

I dont know how much of a thing this will end up being, but we are seeing ChatGPT-written malware in the wild. …within a few weeks of ChatGPT going live, participants in cybercrime forums--­some with little or no coding experience­--were using it to write software and emails that could be used fo...

SUSE-SU-2023:0058-1 Security update for systemd

This update for systemd fixes the following issues: Fixing the following issues: - units: restore RemainAfterExit=yes in systemd-vconsole-setup.service - vconsole-setup: don't concat strv if we don't need to i.e. not in debug log mode - vconsole-setup: add more log messages - units: restore Befor...

Insufficient Entropy In Randomly-Generated Alphanumeric Strings

github.com/masterminds/goutils has insufficient entropy In randomly-generated alphanumeric strings. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9 which significantly reduces the amount of entropy in short strings...

PT-2023-10143 · Unknown · Mapoor Voteapp

Name of the Vulnerable Software and Affected Versions: mapoor voteapp affected versions not specified Description: A critical issue has been found, affecting the function create poll/do poll/show poll/show refresh of the file app.py. This issue leads to sql injection. Recommendations: Apply a pat...