PT-2023-27591 · 大侠Wp · Dx-Auto-Save-Images

Name of the Vulnerable Software and Affected Versions: 大侠wp DX-auto-save-images plugin versions 1.4.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the use...

PT-2023-36057 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. The crash state...

Open5GS 安全漏洞

Open5GS is an open source implementation in C of 5G Core and Epc, the core network of the Lte/Nr network. Open5GS suffers from a security vulnerability that can be exploited by an attacker to intercept VNF Virtual Network Functions communications, thereby exposing sensitive information...

PT-2023-36045 · Git +1 · Libavc

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by a global buffer overflow read. The crash occurs in the following functions: isvce write coeff4x4 cavlc, isvce...

WordPress Plugin Most Popular Posts Widget SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Most Popular Posts Widget...

PT-2023-36042 · Git +1 · Mruby

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the pack unpack function, mrb pack unpack function, and mrb vm exec function...

Unable to update certificate. Error "Certificate is referenced by a CRL, OCSP responder, vserver...)

Getting error "Certificate is referenced by a CRL, OCSP responder, vserver, service, monitor, SSL profile, CA Cert Group, another certificate, or a policy expression using XMLENCRYPT or XMLDECRYPT " when trying to update the existing certificate...

CVE-2023-43656

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions those that have generic.allowJsTransformationFunctions in their config, may be vulnerable to an attack where it is possible to break out of...

CVE-2023-43656 Sandbox escape for instances that have enabled transformation functions in matrix-hookshot

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions those that have generic.allowJsTransformationFunctions in their config, may be vulnerable to an attack where it is possible to break out of...

CVE-2023-43656 Sandbox escape for instances that have enabled transformation functions in matrix-hookshot

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions those that have generic.allowJsTransformationFunctions in their config, may be vulnerable to an attack where it is possible to break out of...

CVE-2023-43656 Sandbox escape for instances that have enabled transformation functions in matrix-hookshot

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions those that have generic.allowJsTransformationFunctions in their config, may be vulnerable to an attack where it is possible to break out of...

CVE-2023-43656

CVE-2023-43656 affects matrix-hookshot. When transformation functions are enabled (generic.allowJsTransformationFunctions), an attacker could break out of the vm2 sandbox, making Hookshot vulnerable. This primarily concerns instances where untrusted users can apply their own transformation functi...

matrix-hookshot injection vulnerability

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. An injection vulnerability exists in matrix-hookshot 4.5.0 and prior versions, which can be exploited to break out of the vm2 sandbox in instances where conversion functions are enabled...

cvxPerVotium() calculation will return zero if all CVX tokens are pending withdrawal as obligations

Lines of code Vulnerability details Summary The implementation of cvxPerVotium contains an edge case that causes it to return an invalid zero value price. Impact The cvxPerVotium function present in the VotingStrategy contract is used to measure the number of held CVX tokens per vAfEth. 144:...

PT-2023-28902 · Github +2 · Github +2

Name of the Vulnerable Software and Affected Versions: matrix-hookshot versions prior to 4.5.0 Description: The issue affects matrix-hookshot, a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances with enabled transformation functions, specifically those...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL11-2023-002)

The version of postgresql installed on the remote host is prior to 11.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL11-2023-002 advisory. A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2023-002)

The version of postgresql installed on the remote host is prior to 14.3-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2023-002 advisory. A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is...

The vulnerability of the Cacti network monitoring software lies in the lack of authentication for critical functions, allowing attackers to escalate their privileges.

The vulnerability of the Cacti network monitoring software is related to the lack of authentication for critical functions. Exploiting this vulnerability can allow attackers to increase their privileges...

OESA-2023-1663 skopeo security update

A command line utility that performs various operations on container images and image repositories Security Fixes: Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.CVE-2023-24537...

The vulnerability of Cloudflare WARP’s VPN service for Android lies in the lack of protection for service-related data. This allows attackers to access confidential information and arbitrary application functions.

The vulnerability of Cloudflare WARP, a VPN service for Android, relates to the lack of protection for service-related data. Exploiting this vulnerability could allow attackers to access confidential information and arbitrary application functions...