Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attack and a denial of service due to Node.js modules protobuf.js, vm2 and word-wrap [CVE-2023-36665, CVE-2023-37903, CVE-2023-37466 and CVE-2023-26115]

Summary IBM App Connect Enterprise is vulnerable to a remote attack and a denial of service due to Node.js modules protobuf.js, vm2 and word-wrap CVE-2023-36665, CVE-2023-37903, CVE-2023-37466 and CVE-2023-26115. The fix includes protobuf.js =7.2.4, word-wrap =1.2.5 and vm2 has been removed from...

UBUNTU-CVE-2023-39320

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules...

SUSE CVE-2023-39320

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules...

PT-2023-27067 · Prestashop · Simpleimportproduct Prestashop Module +1

Name of the Vulnerable Software and Affected Versions: FieldPopupNewsletter Prestashop Module version 1.0.0 SimpleImportProduct Prestashop Module version 1.0.0 Description: A reflected cross-site scripting XSS issue was discovered in the Prestashop modules. The vulnerability is exploited via the...

The vulnerability of the Xwiki Commons modules on the XWiki platform, which is used for creating collaborative web applications. This allows a hacker to execute arbitrary code.

The vulnerability of the XWiki Commons modules on the XWiki platform, which is used for creating collaborative web applications, stems from the failure to address the issue of eliminating special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

GHSA-63VW-RPRV-4F8J CSRF vulnerability in Jenkins Ivy Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules...

CVE-2023-41938

A cross-site request forgery CSRF vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules...

CVE-2023-41938

A cross-site request forgery CSRF vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules...

CVE-2023-41938

A cross-site request forgery CSRF vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules...

CVE-2023-41938

A cross-site request forgery CSRF vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules...

CVE-2023-41938

CVE-2023-41938 is a CSRF flaw in the Jenkins Ivy Plugin (versions ≤ 2.5) that lets attackers delete disabled modules. The issue scope is limited to the Ivy Plugin, with an external attacker requiring user interaction, and the base CVSS v3.1 vector indicates Network access, Low attack complexity, ...

CVE-2023-41938

A cross-site request forgery CSRF vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules...

PT-2023-28176 · Jenkins · Jenkins Ivy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Ivy Plugin versions 2.5 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to delete disabled modules. Recommendations: For Jenkins Ivy Plugin versions 2.5 and earlier, update to a version later...

CVE-2023-41938: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules...

CSRF vulnerability in ivy

ivy 2.5 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to delete disabled modules. As of publication of this advisory, there is no fix. Learn why we announce this...

Metasploit Weekly Wrap-Up

Pumpkin Spice Modules Here in the northern hemisphere, fall is on the way: leaves changing, the air growing crisp and cool, and some hackers changing the flavor of their caffeine. This release features a new exploit module targeting Apache NiFi as well as a new and improved library to interact wi...

CVE-2023-40969

Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery SSRF via admin/modules/bibliography/popp2p.php...

CVE-2023-40970

Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loanrules.php...

CVE-2023-40970

CVE-2023-40970 affects Senayan Library Management Systems SLIMS 9 Bulian v9.6.1. The vulnerability is a SQL Injection in the endpoint admin/modules/circulation/loan_rules.php caused by unsanitized input. Documented impact is high (CVSS v3.1: 8.8; Confidentiality/Integrity/Availability all HIGH). ...