Soccer Engine – Soccer Plugin for WordPress < 1.13 - Cross-Site Request Forgery

Description The Soccer Engine – Soccer Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation when saving match and team settings. This makes it possible for...

kernel: netfilter: xtables sctp out-of-bounds read in match_flags()

A flaw was found in the Netfilter subsystem in the Linux kernel. The sctpmtcheck did not validate the flagcount field. This flaw allows a local privileged CAPNETADMIN attacker to trigger an out-of-bounds read, leading to a crash or information disclosure...

SUSE CVE-2022-48654

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkosf: fix possible bogus match in nfosffind nfosffind incorrectly returns true on mismatch, this leads to copying uninitialized memory area in nftosf which can be used to leak stale kernel stack data to userspa...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a possible false match in the nfosffind function. No details of the vulnerability are provided at this time...

RHEL 8 : python27:2.7 (RHSA-2023:5990)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5990 advisory. Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types...

Security Bulletin: IBM Match 360 is vulnerable to could provide weaker than expected security due to improper resource expiration handling in IBM WebSphere Application Server Liberty (CVE-2023-46158)

Summary IBM Match 360 is vulnerable due to weaker than expected security due to improper resource expiration handling in IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2023-46158 DESCRIPTION:...

Match Systems report on consequences of CBDC implementation, led by CEO Andrei Kutin

By Cyber Newswire Match Systems, a leading authority in crypto crimes investigations and crypto AML solutions provider, has published a comprehensive… This is a post from HackRead.com Read the original post: Match Systems report on consequences of CBDC implementation, led by CEO Andrei Kutin...

BIT-ENVOY-2021-43824 Null pointer dereference in envoy

Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use...

SUSE CVE-2023-45289

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a...

CVE-2023-45289

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a...

CVE-2023-45289

CVE-2023-45289 concerns the Go net/http redirect handling: when following an HTTP redirect to a domain that is not a subdomain/exact match of the initial domain, sensitive headers (e.g., Authorization, Cookie) may be forwarded inappropriately. The connected advisories (e.g., ALAS2DOCKER-2024-045,...

SUSE-SU-2024:0589-1 Security update for qemu

This update for qemu fixes the following issues: - CVE-2021-3638: hw/display/ati2d: Fix buffer overflow in ati2dblt bsc1188609 - CVE-2023-3180: virtio-crypto: verify src and dst buffer length for sym request bsc1213925 - CVE-2023-3354: io: remove io watch if TLS channel is closed during handshake...

Security Bulletin: IBM Match 360 is vulnerable to vulnerable to a denial of service due to HTTP/2 Rapid Reset within IBM WebSphere Application Server Liberty (CVE-2023-44487)

Summary IBM Match 360 is vulnerable to vulnerable to a denial of service due to HTTP/2 Rapid Reset within IBM WebSphere Application Server Liberty. Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/2 protocol. By sending numerous...

Security Bulletin: IBM Match 360 is vulnerable to Apache Santuario used within IBM WebSphere Application Server Liberty (CVE-2023-44483)

Summary IBM Match 360 is vulnerable to Apache Santuario used within IBM WebSphere Application Server Liberty. Apache Santuario could allow a remote authenticated attacker to obtain sensitive information, caused by the storage of a private key in the log files when using the JSR 105 API. By gainin...

PT-2024-14217 · Allegra · Allegra

Name of the Vulnerable Software and Affected Versions: Allegra affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this issue, the product implements a...

OESA-2024-1146 rubygem-actionpack security update

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser. Security Fixes: A regular expression based DoS vulnerability in Action Dispatch 6.0.6.1,...

CVE-2023-49329

Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper handling of untrusted input, enabling an attacker to elevate privileges, execute system commands, and potentially compromise the underlyi...

CVE-2023-49329

Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper handling of untrusted input, enabling an attacker to elevate privileges, execute system commands, and potentially compromise the underlyi...

Command injection

Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper handling of untrusted input, enabling an attacker to elevate privileges, execute system commands, and potentially compromise the underlyi...

CVE-2023-49329

Anomali Match (CVE-2023-49329) before 4.6.2 is vulnerable to OS Command Injection due to improper handling of untrusted input. An authenticated admin user can inject and execute operating system commands, potentially compromising the underlying OS. The earliest affected version is 4.3; fixed in 4...