PT-2024-19582 · Akaunting · Akaunting

Name of the Vulnerable Software and Affected Versions: Akaunting versions 3.1.3 and earlier Description: An OS command injection issue exists, allowing an attacker to manipulate the company locale during app installation to execute system commands on the hosting server. Recommendations: For...

CVE-2024-22836

An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server...

Ubuntu 20.04 LTS : Firefox regressions (USN-6610-2)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6610-2 advisory. USN-6610-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. Tenable has extracted the preceding...

How to Change Veeam Service Provider Console UI Language

Veeam Service Provider Console 9.1 Integrated Feature Starting with Veeam Service Provider Console 9.1, the ability to assign and customize the Portal Language is now an integrated feature able to be configured via the Web UI: Veeam Service Provider Console 9.1 - Configuring Portal Language Artic...

Use-after-free when setting the locale

Version 3.0.0 introduced an AtomicStr type, that is used to store the current locale. It stores the locale as a raw pointer to an Arc. The locale can be read with AtomicStr::asstr. AtomicStr::asstr does not increment the usage counter of the Arc. If the locale is changed in one thread, another...

GHSA-C8V3-JHV9-4PPC Use-after-free when setting the locale

Version 3.0.0 introduced an AtomicStr type, that is used to store the current locale. It stores the locale as a raw pointer to an Arc. The locale can be read with AtomicStr::asstr. AtomicStr::asstr does not increment the usage counter of the Arc. If the locale is changed in one thread, another...

RUSTSEC-2024-0007 Use-after-free when setting the locale

Version 3.0.0 introduced an AtomicStr type, that is used to store the current locale. It stores the locale as a raw pointer to an Arc. The locale can be read with AtomicStr::asstr. AtomicStr::asstr does not increment the usage counter of the Arc. If the locale is changed in one thread, another...

Use-after-free when setting the locale

Version 3.0.0 introduced an AtomicStr type, that is used to store the current locale. It stores the locale as a raw pointer to an Arc. The locale can be read with AtomicStr::asstr. AtomicStr::asstr does not increment the usage counter of the Arc. If the locale is changed in one thread, another...

[SECURITY] Fedora 39 Update: golang-x-text-0.14.0-1.fc39

Text is a repository of text-related packages related to internationalization i18n and localization l10n, such as character encodings, text transformations, and locale-specific text handling...

[SECURITY] Fedora 38 Update: golang-x-text-0.14.0-1.fc38

Text is a repository of text-related packages related to internationalization i18n and localization l10n, such as character encodings, text transformations, and locale-specific text handling...

OSV-2024-7 Heap-buffer-overflow in icu_75::Locale::Locale

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65534 Crash type: Heap-buffer-overflow READ 1 Crash state: icu75::Locale::Locale plurrulefuzzer.cpp...

Configuration logging display language not localized

The default language for the Web Studio configuration logging is English. To change the language, configure the Cloud-DDC locale instead of adjusting the language settings in the web browser...

GHSA-QW4H-3XJJ-84CC Apache Tiles: Unvalidated input may lead to path traversal and XXE

The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relativel...

DEBIAN-CVE-2023-49735

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

UBUNTU-CVE-2023-49735

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

Apache Tiles Path Traversal Vulnerability

Apache Tiles is a page layout framework for JavaEE applications from the Apache Foundation. A path traversal vulnerability exists in Apache Tiles prior to version 2.0.0, which stems from failing to validate the value of the DefaultLocaleResolver.LOCALEKEY attribute set on a session when parsing a...

PT-2023-31314 · Apache +1 · Apache Tiles +1

Name of the Vulnerable Software and Affected Versions: Apache Tiles versions 2 onwards Description: The issue arises from the lack of validation of the value set as the DefaultLocaleResolver.LOCALE KEY attribute on the session while resolving XML definition files. This can lead to possible path...

PKP customLocale Cross-Site Request Forgery Vulnerability

PKP customLocale is PKP's custom locale plugin for OPS, OJS and OMP. A cross-site request forgery vulnerability exists in PKP customLocale versions prior to 1.2.0-1, which can be exploited by an attacker to send a fake request to a user...

PT-2023-32404 · Unknown · Pkp/Customlocale

Name of the Vulnerable Software and Affected Versions: pkp/customLocale versions prior to 1.2.0-1 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository pkp/customLocale. CSRF is an attack that tricks a user into performing unintended actions on a web...

PKP Plugin Custom Locale Cross-Site Request Forgery Vulnerability

PKP Plugin Custom Locale is a plugin from PKP Inc. A cross-site request forgery vulnerability exists in PKP Plugin Custom Locale versions prior to 1.2.0-1, which stems from a missing CSRF check and can be exploited by an attacker to send a fake request to a user...