PT-2023-30403 · Cubecart · Cubecart

Name of the Vulnerable Software and Affected Versions: CubeCart versions prior to 6.5.3 Description: A directory traversal issue allows a remote authenticated attacker with administrative privileges to obtain files in the system. Recommendations: For versions prior to 6.5.3, update to version 6.5...

PT-2023-30475 · Woocommerce · Gravity Master Product Enquiry For Woocommerce

Name of the Vulnerable Software and Affected Versions: Gravity Master Product Enquiry for WooCommerce plugin versions prior to 3.0 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a...

PT-2023-30472 · WordPress · Ioannup Edit Woocommerce Templates

Name of the Vulnerable Software and Affected Versions: ioannup Edit WooCommerce Templates plugin versions 1.1.1 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

PT-2023-30737 · Tinymce · Tinymce

Name of the Vulnerable Software and Affected Versions: TinyMCE versions prior to 5.10.9 TinyMCE versions prior to 6.7.3 Description: A mutation cross-site scripting mXSS vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific...

Missing sanity checks in Chainlink response

Lines of code Vulnerability details Summary Chainlink responses from price feeds are being used without any sanity checks. Impact The ChainlinkPriceOracle contract is used to interface with the Chainlink price feeds for the different LST assets in scope in the protocol. The current implementation...

Missing slippage check in deposit function

Lines of code Vulnerability details Summary Users depositing in the protocol have no control over the amount of RSETH minted in return for their deposit. Impact The depositAsset function present in the LRTDepositPool contract allows users to deposit any of the supported assets into the protocol i...

Missing pause checks in LRTOracle

Lines of code Vulnerability details Summary The LRTOracle oracle provides functionality to pause the contract but no restrictions are applied when the contract is in a paused state. Impact Similar to the other contracts in the protocol, the LRTOracle contract offers pausing functionality: 101: //...

CVE-2023-6111 Use-after-free in Linux kernel's netfilter: nf_tables component

A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The function nfttransgccatchall did not remove the catchall set element from the catchalllist when the argument sync is true, making it possible to free a...

DoS (Denial of Service) json-java in Bamboo Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.1 and 9.3.0 of Bamboo Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H...

PT-2023-7262 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.9 and earlier Description: The issue is related to an out-of-bounds read vulnerability in the memory, which could allow an attacker to gain unauthorized access to protected information by using a specially crafted...

PT-2023-7280 · Intel · Intel Rapid Storage Technology

Name of the Vulnerable Software and Affected Versions: Intel Rapid Storage Technology versions prior to 16.8.5.1014.9 Description: The issue is related to insecure inherited permissions in Intel Rapid Storage Technology, which can be exploited to potentially enable escalation of privilege via loc...

Intel® Battery Life Diagnostic Tool Software Advisory

Summary: Potential security vulnerabilities in some Intel® Battery Life Diagnostic Tool software may allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2023-34430 Description: Uncontrolled search path i...

Intel® DCM Software Advisory

Summary: A potential security vulnerability in some Intel® Data Center Manager DCM software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-31273 Description: Protection mechanism failure in so...

PT-2023-23661 · Intel · Intel Ofu

Name of the Vulnerable Software and Affected Versions: IntelR OFU software versions prior to 14.1.31 Description: The issue is related to improper access control in IntelR OFU software, which may allow an authenticated user to potentially enable escalation of privilege via local access...

Intel® QAT Advisory

Summary: A potential security vulnerability in the Intel® QuickAssist Technology QAT software for linux may allow escalation of privilege and denial of service. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-32641 Description:...

Intel® Chipset Device Software Advisory

Summary: A potential security vulnerability in some Intel® Chipset Device Software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-28388 Description: Uncontrolled search path element in some...

Intel® Connectivity Performance Suite Software Advisory

Summary: A potential security vulnerability in the Intel® Connectivity Performance Suite software for some Intel® Wireless Products may allow information disclosure. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-32279...

Intel® Ethernet Controllers and Adapters Advisory

Summary: A potential security vulnerability in some Intel® Ethernet Controllers and Adapters may allow denial of service. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-28376 Description: Out-of-bounds read in the firmware for...

Intel® Server Board and Server System Firmware Advisory

Summary: Potential security vulnerabilities in some Intel® Server Board and Server System BIOS firmware may allow escalation of privilege. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2023-34431 Description: Improper input...

Intel® Server Information Retrieval Utility Software Advisory

Summary: A potential security vulnerability in some Intel® Server Information Retrieval Utility software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-27513 Description: Uncontrolled search...