CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore

Pimcore is an Open Source Data & Experience Management Platform. In affected versions the /admin/object/grid-proxy endpoint calls getFilterCondition on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL. One implementation of getFilterConditi...

CVE-2023-47637

Pimcore contains a SQL injection in the Admin Grid Filter API. In affected versions, the /admin/object/grid-proxy endpoint calls getFilterCondition() on class fields to build SQL from user input, and Multiselect’s implementation does not normalize/escape/validate that input. This allows any backe...

CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore

Pimcore is an Open Source Data & Experience Management Platform. In affected versions the /admin/object/grid-proxy endpoint calls getFilterCondition on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL. One implementation of getFilterConditi...

CVE-2023-48219

Summary of CVE-2023-48219 (TinyMCE): A mutation XSS (mXSS) flaw in TinyMCE’s core undo/redo and related APIs/plugins arises from text nodes in certain parents not being escaped during serialization per HTML standards. If a text node contains a special internal marker, it can combine with other HT...

CVE-2023-47127

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the...

CVE-2023-47127

TYPO3 core vulnerability CVE-2023-47127: in installations with multiple sites, a session cookie from one site can be reused on another without re-authentication. Affects TYPO3 CMS core; remediation is to upgrade to fixed versions (8.7.55, 9.5.44, 10.4.41, 11.5.33, 12.4.8). The connected advisorie...

[SECURITY] Fedora 39 Update: chromium-119.0.6045.123-1.fc39

Chromium is an open-source web browser, powered by WebKit Blink...

Default credentials

DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account given certain preconditions. If the defau...

CVE-2023-47628 Session Expiration Misconfiguration in datahub

DataHub is an open-source metadata platform. DataHub Frontend's sessions are configured using Play Framework's default settings for stateless session which do not set an expiration time for a cookie. Due to this, if a session cookie were ever leaked, it would be valid forever. DataHub uses a...

CVE-2023-47628

CVE-2023-47628 describes a session-management flaw in DataHub Frontend where Play Framework default settings create a stateless cookie without expiration. The root cause is a cookie policy that does not set an expiration time, compounded by use of LegacyCookiesModule, making a leaked session cook...

Moderate: grafana security and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: account takeover possible when using Azure AD OAuth CVE-2023-3128 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...

Microsoft Visual Studio Code Security Vulnerability

Microsoft Visual Studio Code is an open source code editor from Microsoft USA. A security vulnerability exists in Microsoft Visual Studio Code. An attacker exploits the vulnerability to perform spoofing attacks...

Moderate: libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and...

CVE-2023-47117

Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on t...

VulnCheck KEV: CVE-2023-38646

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2...

Pleasanter Security Vulnerability

Pleasanter is a free OSS no-code/low-code development tool from Pleasanter. A security vulnerability exists in Pleasanter. An attacker can exploit the vulnerability to perform cross-site scripting attacks...

Malicious code in ifl-primitives (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cbddd298006615ef0975b9e718d03ba67c4cf761be2dc4048648ebd2866c0fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CryptoChat - Beyond Secure Messaging

Welcome to CryptChat - where conversations remain truly private. Built on the robust Python ecosystem, our application ensures that every word you send is wrapped in layers of encryption. Whether you're discussing sensitive business details or sharing personal stories, CryptChat provides the...

Fostering Innovation in Web Security

Ive always created growth by focusing on free. It started back in 2003 when I launched WorkZoo in London. WorkZoo was a job search engine that ended up being one of Time Magazines top 50 websites of 2005. These days we take free search capability for granted, but 20 years ago, before Nginx came...

CVE-2023-46130

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, some theme components allow users to add svgs with unlimited height attributes, and this can affect the availability of...