CVE-2023-28645 Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments

Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a man-in-the-middle attack in cURL libcurl (CVE-2022-32208)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a man-in-the-middle attack in cURL libcurl caused by a flaw in the handling of message verification failures. CVE-2022-32208. cURL libcurl is included as part of the Base OS used by our service images. Please...

SUSE CVE-2023-0870

A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer...

PT-2023-22002 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud server versions prior to 24.0.10 Nextcloud server versions prior to 25.0.4 Description: The issue affects Nextcloud server, an open source home cloud implementation, where users who should not have download permissions can still...

PT-2023-16727 · Ykm Crm · Ykm Crm

Name of the Vulnerable Software and Affected Versions: YKM CRM versions prior to 23.03.30 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS attacks. Recommendations: For versions prio...

PT-2023-15229 · Generex · Generex Ups Cs141

Name of the Vulnerable Software and Affected Versions: Generex UPS CS141 versions prior to 2.06 Description: The issue allows an attacker to upload a firmware file containing an incorrect configuration, disrupting the normal functionality of the device. Recommendations: For versions prior to 2.06...

CVE-2023-28833 Unrestricted filenames for logo or favicon as admin in the theming settings in nextcloud server

Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted and could overwrite files in the appdata directory. Administrators may have access to overwrite these...

CVE-2023-28833 Unrestricted filenames for logo or favicon as admin in the theming settings in nextcloud server

Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted and could overwrite files in the appdata directory. Administrators may have access to overwrite these...

CVE-2023-28644 Reference fetch can saturate the server bandwidth for 10 seconds in nextcloud server

Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the Nextcloud Server is...

CVE-2023-28646 App lockout in nextcloud Android app can be bypassed via thirdparty apps

Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This allows to see meta...

PT-2023-21871

Name of the Vulnerable Software and Affected Versions Nextcloud Android versions 3.7.0 through 3.24.0 Description The Nextcloud Android app has a security issue that allows an attacker with access to an unlocked physical device to bypass the Pin/passcode protection using a third-party app. This...

PT-2023-4757

Name of the Vulnerable Software and Affected Versions angular versions 1.0.0 and later Description The issue is related to the $resource service in angular, which uses an insecure regular expression. This can lead to a Regular Expression Denial of Service ReDoS when a large, carefully-crafted inp...

PT-2023-19889 · WordPress · Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: Shortcodes Ultimate plugin versions = 5.12.6 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability affects users with contributor or higher permissions. There is no information provided about...

PT-2023-21164

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.1 Description The issue arises from Kiwi TCMS accepting SVG files uploaded by users, which could contain JavaScript code. If these SVG images are viewed directly, the JavaScript code could execute. This has been...

PT-2023-15776 · Jetbrains · Jetbrains Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2023.1 Description: The issue concerns the bundled version of Chromium in JetBrains IntelliJ IDEA, which was not sandboxed. This lack of sandboxing could potentially lead to security issues...

PT-2023-15426 · Wpdevart · Wpdevart Gallery – Image/Video Gallery With Thumbnails

Name of the Vulnerable Software and Affected Versions: wpdevart Gallery – Image and Video Gallery with Thumbnails plugin versions prior to 2.0.1 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scrip...

PT-2023-15314 · Unknown · Wpdevart Booking Calendar +1

Name of the Vulnerable Software and Affected Versions: WpDevArt Booking calendar, Appointment Booking System plugin versions 3.2.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by authenticated users with edit...

PT-2023-20476

Name of the Vulnerable Software and Affected Versions Arm Mali GPU Kernel Driver versions r6p0 through r32p0 Arm Mali GPU Kernel Driver versions r0p0 through r42p0 Arm Mali GPU Kernel Driver versions r19p0 through r42p0 Arm Mali GPU Kernel Driver versions r41p0 through r42p0 Description A memory...

PT-2023-15425 · Joomunited · Wp Table Manager

Name of the Vulnerable Software and Affected Versions: JoomUnited WP Table Manager plugin versions prior to 3.5.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher privileges. There is no...

PT-2023-19261 · German Mesky · Gmace Plugin

Name of the Vulnerable Software and Affected Versions: German Mesky GMAce plugin versions = 1.5.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticat...