USN-6104-1: PostgreSQL vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description Alexander Lakhin discovered that PostgreSQL incorrectly handled certain CREATE privileges. An authenticated user could possibly use this issue to execute arbitrary code as the...

USN-6165-1: GLib vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that GLib incorrectly handled non-normal GVariants. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or perform other unknown attacks. Update...

ghostscript:gstoraster_pdf_fuzzer: Heap-buffer-overflow in default_get_outline

Detailed Report: https://oss-fuzz.com/testcase?key=4653827832545280 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterpdffuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6310000ec924 Crash State:...

ffmpeg:ffmpeg_AV_CODEC_ID_HEVC_fuzzer: Memcpy-param-overlap in put_hevc_pel_uni_pixels_10

Detailed Report: https://oss-fuzz.com/testcase?key=4992746590175232 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDHEVCfuzzer Job Type: libfuzzerasani386ffmpeg Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address: 0xf6635d00,0xf6635d10 and 0xf6635cfc, 0xf6635d0...

apache-commons-configuration:XMLConfigurationWriteFuzzer: Security exception in com.code_intelligence.jazzer.sanitizers.ServerSideRequestForgery.checkSsrf

Detailed Report: https://oss-fuzz.com/testcase?key=6596136799174656 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: XMLConfigurationWriteFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Security exception Crash Address: Crash...

jdom:SAXBuilderFuzzer: Security exception in com.code_intelligence.jazzer.sanitizers.ServerSideRequestForgery.checkSsrf

Project: https://github.com/hunterhacker/jdom.git Detailed Report: https://oss-fuzz.com/testcase?key=5420846446149632 Project: jdom Fuzzing Engine: libFuzzer Fuzz Target: SAXBuilderFuzzer Job Type: libfuzzerasanjdom Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Advisory ROSA-SA-2023-2175

Software: apr-util 1.5.2-6 OS: rosa-server79 packageevrstring: apr-util-1.5.2-6.res7.1 CVE-ID: CVE-2022-25147 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Inte Overflow or Wraparound vulnerability in Apache Portable Runtime Utility APR-util aprbase64 functions allows an attacker to write data outside...

WordPress Editorial Calendar Plugin <= 3.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Editorial Calendar Type Plugin Vulnerable versions = 3.8.0 Fixed in 3.8.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4115 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID ecc03a6dec25 Credits iohex Required...

zeek:zeek-packet-fuzzer: Heap-buffer-overflow in zeek::packet_analysis::VLAN::VLANAnalyzer::AnalyzePacket

Project: https://github.com/zeek/zeek.git Detailed Report: https://oss-fuzz.com/testcase?key=6428589923631104 Project: zeek Fuzzing Engine: honggfuzz Fuzz Target: zeek-packet-fuzzer Job Type: honggfuzzasanzeek Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60700228379...

harfbuzz:hb-subset-fuzzer: Use-of-uninitialized-value in CFF::Charset::serialize

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=4552226966994944 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

WordPress InventoryPress Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)

Software InventoryPress Type Plugin Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2579 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 980d01840734 Credits daniloalbuqrque Require...

WordPress Restrict Content Plugin < 3.2.3 is vulnerable to Broken Access Control

Software Restrict Content Type Plugin Vulnerable versions 3.2.3 Fixed in 3.2.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 64157ce6271e Credits Unknown Required privilege Subscrib...

WordPress BBS e-Popup Plugin <= 2.4.5 is vulnerable to Broken Access Control

Software BBS e-Popup Type Plugin Vulnerable versions = 2.4.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36504 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7cabb71ca4f5 Credits Abdi Pranata Required privile...

WordPress Gallery Metabox Plugin <= 1.5 is vulnerable to Broken Access Control

Software Gallery Metabox Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2561 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 640496049b74 Credits Marco Wotschka Required...

WordPress Gallery Metabox Plugin <= 1.5 is vulnerable to Broken Access Control

Software Gallery Metabox Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2562 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 1b3822efa9e8 Credits Marco Wotschka Required...

WordPress Go Pricing Plugin < 3.4 is vulnerable to Cross Site Scripting (XSS)

Software Go Pricing Type Plugin Vulnerable versions 3.4 Fixed in 3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2498 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 27531616264d Credits Lana Codes Required privilege...

libdwarf:fuzz_set_frame_all: Crash in _dwarf_exec_frame_instr

Project: https://github.com/davea42/libdwarf-code.git Detailed Report: https://oss-fuzz.com/testcase?key=6613067367317504 Project: libdwarf Fuzzing Engine: afl Fuzz Target: fuzzsetframeall Job Type: aflasanlibdwarf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x605ffde00049 Crash...

WordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)

Software EventPrime Type Plugin Vulnerable versions = 3.0.5 Fixed in 3.0.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-35884 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0d78f3844de4 Credits Le Ngoc Anh Required...

bitcoin-core:wallet_notifications: Use-of-uninitialized-value in sqlite3Strlen30

Detailed Report: https://oss-fuzz.com/testcase?key=6300317680271360 Project: bitcoin-core Fuzzing Engine: libFuzzer Fuzz Target: walletnotifications Job Type: libfuzzermsanbitcoin-core Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: sqlite3Strlen30...

pcapplusplus:FuzzTarget: Heap-buffer-overflow in pcpp::SSLClientHelloMessage::SSLClientHelloMessage

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=6303327798034432 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerasanpcapplusplus Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash...