PT-2023-31406 · Apache · Maven

Name of the Vulnerable Software and Affected Versions: streampark versions prior to 2.1.2 Description: The issue is related to the project module in streampark that integrates Maven's compilation capability. There is no check on the compilation parameters of Maven, allowing attackers to insert...

Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server

Summary IBM Db2 is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM Db2 have been published in a security bulletin CVE-2015-8383, CVE-2015-8381, CVE-2015-8386, CVE-2015-8388, CVE-2015-8385, CVE-2015-8387, CVE-2015-8391, CVE-2015-8390, CVE-2015-839...

PT-2023-31573 · Cjson +3 · Cjson +3

Name of the Vulnerable Software and Affected Versions: cJSON version 1.7.16 Description: The issue is related to a segmentation violation in the function cJSON SetValuestring at cJSON.c. This indicates a potential problem with memory access that could lead to a crash or other unintended behavior...

Security Bulletin: Multiple security vulnerabilities in systemd may affect IBM Storage Scale System

Summary Multiple security vulnerabilities has been identified in IBM Storage Scale System where systemd is vulnerable to denial of service. A fix for these vulnerabilities is available. Vulnerability Details CVEID:CVE-2022-4415 DESCRIPTION: systemd could allow a local authenticated attacker to...

December 12, 2023—KB5033424 (Security-only update)

None None...

PT-2023-8629 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.10 and earlier Description: The issue is related to an out-of-bounds read vulnerability in Adobe Dimension, which could lead to the disclosure of sensitive memory. This can be exploited by an attacker to bypass...

WordPress Contact Form To Any API 1.1.6 Cross Site Request Forgery Vulnerability

Exploit Title: WP Plugins Contact Form to Any API history.pushState'', '', '/'; document.forms0.submit; Recommendation Upgrade to version 1.1.7...

PT-2023-27425 · Apple · Macos Sonoma +1

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.2 Description: A privacy issue was addressed by moving sensitive data to a protected location. This issue allows an app to potentially access user-sensitive data. Recommendations: For macOS Sonoma versions...

CVE-2023-6646

CVE-2023-6646 affects linkding 1.23.0. The vulnerability arises from an XSS in the handling of the query parameter q, enabling remote exploitation. Public exploit exists. Upgrading to version 1.23.1 addresses the issue. Several sources across CVE records corroborate the XSS in the q parameter and...

PT-2023-31544

Name of the Vulnerable Software and Affected Versions Bitcoin Core versions prior to 26.1 Bitcoin Knots versions prior to 25.1.knots20231115 Description Datacarrier size limits can be bypassed by obfuscating data as code, such as using OP FALSE OP IF. This issue was exploited in the wild by...

Potential Gas Inefficiency due to Unnecessary abi.encode Usage

Lines of code Vulnerability details Impact The function unnecessarily uses abi.encode to convert a uint256 to bytes32, incurring additional gas costs. This doesn't affect correctness but may lead to suboptimal gas usage. Proof of Concept By modifying the fetchInteractionId function to directly ca...

Upgraded Q -> 2 from #677 [1702060237936]

Judge has assessed an item in Issue 677 as 2 risk. The relevant finding follows: L-04 Deposited amounts in the EigenLayer strategy should be checked before updating the strategy for the asset Users deposit in this protocol and the protocol deposits these funds to EigenLayer strategy contracts...

XXE (XML External Entity Injection) jackson-databind in Jira Software Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.20.0, 9.4.0, 9.5.0, and 9.6.0 of Jira Software Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows ...

PT-2023-9073 · Oracle · Primavera P6 Enterprise Project Portfolio Management

Name of the Vulnerable Software and Affected Versions: Primavera P6 Enterprise Project Portfolio Management versions 19.12.0 through 19.12.22 Primavera P6 Enterprise Project Portfolio Management versions 20.12.0 through 20.12.21 Primavera P6 Enterprise Project Portfolio Management versions 21.12....

PT-2023-9571

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23 Oracle GraalVM for JDK versions 17.0.12, 21.0.4, 23 Oracle GraalVM Enterprise Edition versions 20.3.15, 21.3.11 Description The issue is related to the Serialization...

PT-2023-9592 · Oracle +1 · Virtualbox +1

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 7.0.22 Oracle VM VirtualBox versions prior to 7.1.2 Description: The issue is related to insufficient protection of internal data in the Core component of Oracle VM VirtualBox, allowing a high-privileged...

PT-2023-24878 · Unknown · Pleasanter

Name of the Vulnerable Software and Affected Versions: Pleasanter versions 1.3.47.0 and earlier Description: The issue is a stored cross-site scripting vulnerability. If exploited, it allows an arbitrary script to be executed on the user's web browser. Recommendations: For Pleasanter versions...

CVE-2023-41835 Apache Struts: excessive disk usage

When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which...

CVE-2023-41835 Apache Struts: excessive disk usage

When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which...

PT-2023-32310 · WordPress · Filr

Name of the Vulnerable Software and Affected Versions: Filr WordPress plugin version 1.2.3.6 and earlier Description: The issue allows for Remote Code Execution RCE, enabling the operating system to execute commands and fully compromise the server on behalf of a user with Author-level privileges...