jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos

A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service...

PT-2023-17929 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-11 through Android-13 Description: The issue arises from uncaught exceptions in job map parsing within several methods of JobStore.java, potentially leading to a local persistent denial of service. This can occur...

CVE-2023-34448

Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default filter function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke...

CVE-2023-34448: Improper Input Validation

Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default filter function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke...

CVE-2023-29175

An improper certificate validation vulnerability CWE-295 in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0 through 7.2.3 may allow a remote and unauthenticated attacker to perform a...

CVE-2023-29175: Improper Certificate Validation

An improper certificate validation vulnerability CWE-295 in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0 through 7.2.3 may allow a remote and unauthenticated attacker to perform a...

Fortinet Fortigate Lack of certificate verification when establishing secure connections (FG-IR-22-468)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-468 advisory. - An improper certificate validation vulnerability CWE-295 in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.1...

Strava heatmap loophole may reveal users' home addresses

Researchers at NC State University have outlined potential privacy issues with popular fitness app Strava which could lead to users' homes being pinpointed. The researchers' findings are detailed in a paper called Heat marks the spot: de-anonymising users' geographical data on the Strava heat map...

Lack of certificate verification when establishing secure connections

...

PT-2023-13310 · Qualcomm · Snapdragon +98

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue is related to a memory corruption problem caused by a double free error in automotive systems. This occurs when an invalid HLOS address for one of the lists to be mapped i...

CVE-2023-32217

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments...

CVE-2023-32217

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments...

WordPress Page Builder with Image Map by AZEXO Plugin <= 1.27.133 is vulnerable to Cross Site Scripting (XSS)

Software Page Builder with Image Map by AZEXO Type Plugin Vulnerable versions = 1.27.133 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3051 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID edf66099cf29...

WordPress Page Builder with Image Map by AZEXO Plugin <= 1.27.133 is vulnerable to Broken Access Control

Software Page Builder with Image Map by AZEXO Type Plugin Vulnerable versions = 1.27.133 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-3053 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID bcb4f38dcc4d Credits...

WordPress Page Builder with Image Map by AZEXO Plugin <= 1.27.133 is vulnerable to Cross Site Scripting (XSS)

Software Page Builder with Image Map by AZEXO Type Plugin Vulnerable versions = 1.27.133 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3055 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID f4849bd1e963 Credits...

WordPress Page Builder with Image Map by AZEXO Plugin <= 1.27.133 is vulnerable to Cross Site Request Forgery (CSRF)

Software Page Builder with Image Map by AZEXO Type Plugin Vulnerable versions = 1.27.133 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3052 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 3ed12ddc506d Credit...

IdentityIQ 安全漏洞

IdentityIQ is a security software from IdentityIQ, Inc. which provides credit monitoring, identity insurance, and antivirus. IdentityIQ suffers from a security vulnerability that stems from allowing an authenticated user to call a Java constructor without parameters or a Java constructor with a...

ASB-A-246541702

In several methods of JobStore.java, uncaught exceptions in job map parsing could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-23663 · Sailpoint · Identityiq

Name of the Vulnerable Software and Affected Versions: IdentityIQ versions 8.0 through 8.0p5 IdentityIQ versions 8.1 through 8.1p6 IdentityIQ versions 8.2 through 8.2p5 IdentityIQ versions 8.3 through 8.3p2 Description: The issue allows an authenticated user to invoke a Java constructor with no...

CVE-2023-33180

Xibo is a content management system CMS. An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the /display/map API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted valu...