CVE-2023-34320

Cortex-A77 cores r0p0 and r1p0 are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of either a load to device or non-cacheable memory, and either a store exclusive or register read of the Physical Address Register PAREL1 in close...

OESA-2023-1898 freeimage security update

FreeImage is a library project for developers who would like to support popular graphics image formats PNG, JPEG, TIFF, BMP and others. Some highlights are: extremely simple in use, not limited to the local PC unique FreeImageIO and Plugin driven! Security Fixes: Buffer Overflow vulnerability in...

The vulnerability of the remote control function of the PowerStation load balancing system allows a hacker to execute arbitrary commands or cause service failures.

The vulnerability of the remote control function of the PowerStation network load balancing system is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands ...

PT-2023-24812 · Arm +1 · Cortex-A77 +1

Name of the Vulnerable Software and Affected Versions: Cortex-A77 cores versions r0p0 and r1p0 Description: The issue arises when software, under certain circumstances, could deadlock a core due to the execution of either a load to device or non-cacheable memory, and either a store exclusive or...

The vulnerability of the PowerStation network load balancing system, related to insufficient protection of operational data, allows a intruder to gain unauthorized access to protected information, execute arbitrary code, or cause a service failure.

The vulnerability of the PowerStation network load balancing system is related to the lack of authentication for critical functions, resulting from insufficient protection of operational data. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected...

PT-2023-31157 · Google · Google-Api-Python-Client

Name of the Vulnerable Software and Affected Versions: PyDrive2 versions prior to 1.16.2 Description: PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserialization will result in arbitrary code execution. A maliciously...

Information disclosure

In loadMediaDataInBgForResumption of MediaDataManager.kt, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-47106

Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path...

Improper access control

Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path...

CVE-2023-47633

CVE-2023-47633 affects the Traefik Docker image when it serves as its own backend, triggered by an automatically generated route from Docker integration in default configuration. The issue causes 100% CPU usage, leading to a denial of service-like impact on the affected instance. The vulnerabilit...

CVE-2023-47633 Uncontrolled Resource Consumption in Traefik

Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions...

CVE-2023-47106

Traefik vulnerability CVE-2023-47106: when a request contains a URL fragment, Traefik URL-encodes and forwards the fragment to the backend, violating RFC 7230 (origin-form should only have path and query). In a setup with a frontend proxy like Nginx, this can bypass URI-based access controls. Add...

CVE-2023-47106 Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik

Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path...

CVE-2023-47124

CVE-2023-47124 describes a DoS vector in Traefik when using HTTPChallenge to obtain/renew Let’s Encrypt TLS certificates: the 50-second delay allowed solving the challenge can be abused for a slowloris-style attack. Public details in the initial document specify impacts as a server availability r...

PT-2023-27256 · Google · Android

Name of the Vulnerable Software and Affected Versions: MediaDataManager.kt affected versions not specified Description: The issue is related to a confused deputy in the loadMediaDataInBgForResumption function of MediaDataManager.kt, allowing potential access to another user's images. This could...

OSV-2023-1247 Heap-buffer-overflow in r_bin_coff_new_buf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64638 Crash type: Heap-buffer-overflow READ 4 Crash state: rbincoffnewbuf load rbinobjectnew...

PT-2023-29234 · Electron · Electron

Name of the Vulnerable Software and Affected Versions: Electron versions prior to 22.3.24 Electron versions prior to 24.8.3 Electron versions prior to 25.8.1 Electron versions prior to 26.2.1 Electron versions prior to 27.0.0-alpha.7 Description: This issue impacts Electron apps that have the...

Design/Logic Flaw

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/itemsview.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to sto...

User enumeration or launch failures after upgrading Citrix StoreFront to LTSR 2203 CU4

After upgrading Citrix Storefront to 2203 Cu4, a high number of launchfailures or enumeration may be reported by end users. Upon checking, you may notice that there is a high load on the CTXSite database which is related to stored procedures being invoked. As a result of this, it causes session...

Virtuozzo Hybrid Infrastructure 6.0 (6.0.0-243)

In this release, Virtuozzo Hybrid Infrastructure provides an upgrade of the Linux distribution, kernel, and toolset packages. This release also contains a range of new features that cover storage performance, object storage, as well as monitoring and alerts. Additionally, this release delivers...