[SECURITY] Fedora 37 Update: netconsd-0.4-1.fc37

This is a daemon for receiving and processing logs from the Linux Kernel, as emitted over a network by the kernel's netconsole module. It supports both the old "legacy" text-only format, and the new extended format added in v4.4. The core of the daemon does nothing but process messages and drop...

CVE-2023-46352

In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" facebookconversiontrackingplus up to version 2.4.9 from Smart Modules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from...

Design/Logic Flaw

In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" facebookconversiontrackingplus up to version 2.4.9 from Smart Modules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from...

CVE-2023-46352

In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" facebookconversiontrackingplus up to version 2.4.9 from Smart Modules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution offers multiple payment methods, SMS alerts, and product image scaling. A security vulnerability exists in PrestaShop Smart Modules for PrestaShop 2.4.9 and earlier versions, which stems from...

CVE-2023-46352

In CVE-2023-46352, the Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module (PrestaShop Smart Modules) up to version 2.4.9 exposes a permissions flaw that lets a guest download exports, leaking personal data from the ps_customer table (name, surname, email). Root cause: lack of proper ac...

CVE-2023-46352: Missing Authorization

In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" facebookconversiontrackingplus up to version 2.4.9 from Smart Modules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from...

CVE-2023-1719: Improper Initialization

Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to 1 enumerate attachments on the server and 2 execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim ha...

openshift: OCP & FIPS mode

A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated...

CVE-2023-46356

In the module "CSV Feeds PRO" csvfeeds before 2.6.1 from Bl Modules for PrestaShop, a guest can perform SQL injection. The method SearchApiCsv::getProducts has sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection...

SUSE CVE-2018-1113

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pamshells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstance...

CVE-2023-45798

In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution...

CVE-2023-45798

In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution...

Input validation

In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution...

CVE-2023-45798

Affected product: Yettiesoft VestCert, versions 2.36–2.5.29. Root cause: improper validation of third-party modules allows loading arbitrary third-party modules, enabling remote code execution. Impact: remote code execution with high risk (CVE-2023-45798). The CVE notes indicate vulnerability is ...

CVE-2023-45798: Inclusion of Functionality from Untrusted Control Sphere

In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution...

PT-2023-29692 · Yettiesoft · Vestcert

Name of the Vulnerable Software and Affected Versions: Yettiesoft VestCert versions 2.36 to 2.5.29 Description: A vulnerability exists in Yettiesoft VestCert due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote co...

Yettiesoft VestCert Security Vulnerability

Yettiesoft VestCert is an application from Yettiesoft, Inc. A security vulnerability exists in Yettiesoft VestCert versions 2.36 through 2.5.29 that stems from improper validation of third-party modules, which allows malicious actors to load arbitrary third-party modules that can lead to remote...

CVE-2023-46503

Cross Site Scripting XSS vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a remote attacker to execute arbitrary code via the reader management and book input modules...

YXBOOKCMS Cross-Site Scripting Vulnerability

YXBOOKCMS is a content management system by PwnCYN individual developers. A security vulnerability exists in YXBOOKCMS v.1.0.2, which allows remote attackers to execute arbitrary code via the reader management and book input modules...