Nomad Caller ACL Token's Secret ID is Exposed to Sentinel

Summary A vulnerability was identified in Nomad Enterprise such that the API caller’s ACL token secret ID is exposed to Sentinel policies. This vulnerability, CVE-2023-3299, affects Nomad Enterprise from 1.2.11 up to 1.5.6, and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11. Background Nomad...

PT-2023-21771 · Ibm · Ibm Mq Appliance +1

Name of the Vulnerable Software and Affected Versions: IBM MQ versions 9.0 LTS through 9.3 LTS IBM MQ versions 9.2 CD through 9.3 CD IBM MQ Appliance versions 9.2 LTS through 9.3 LTS IBM MQ Appliance versions 9.2 CD through 9.2 LTS Description: The issue is caused by an error processing messages,...

PT-2023-22921 · Hashicorp +1 · Hashicorp Nomad +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise versions 0.7.0 through 1.5.6 HashiCorp Nomad and Nomad Enterprise version 1.4.10 Description: A vulnerability in HashiCorp Nomad and Nomad Enterprise allows an ACL policy using a block without a label to...

PT-2023-3666

Name of the Vulnerable Software and Affected Versions OpenSSH versions 7.9p1-alt4.gost.p10.1, 7.9p1-alt4.p10.6, 9.6p1-alt1.gost, 9.6p1-alt2.gost Description OpenSSH contains a vulnerability where the ssh-agent component incorrectly handles loading certain PKCS11 providers. This can allow a remote...

PT-2024-03: Vulnerability of reading internal application files in OpenKeychain

The vulnerability was identified in OpeKeychain v.5.8.2 58902. It allows a potential attacker to read any files available to an application including from the application sandbox and save files to external storage. The vulnerability is caused by insufficient filtering of input parameters...

PT-2023-3984 · Oracle · Oracle Business Intelligence Enterprise Edition

Name of the Vulnerable Software and Affected Versions: Oracle Business Intelligence Enterprise Edition versions 6.4.0.0.0 and 7.0.0.0.0 Description: The issue is related to errors in processing input data in the Analytics Server component of Oracle Business Intelligence Enterprise Edition. This...

PT-2023-6721 · Iagona · Iagona Scrutisweb

Name of the Vulnerable Software and Affected Versions: Iagona ScrutisWeb versions 2.1.37 and prior Description: The issue is related to an insecure direct object reference vulnerability. This could allow an unauthenticated user to view profile information, including user login names and encrypted...

PT-2023-4026 · Oracle · Oracle Business Intelligence Enterprise Edition

Name of the Vulnerable Software and Affected Versions: Oracle Business Intelligence Enterprise Edition version 6.4.0.0.0 Description: The issue is related to errors in processing input data in the Visual Analyzer component of Oracle Business Intelligence Enterprise Edition. This can allow a remot...

PT-2023-26163 · Pluginpress · Pluginpress Shortcode Imdb

Name of the Vulnerable Software and Affected Versions: PluginPress Shortcode IMDB plugin versions 6.0.8 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended action...

PT-2023-21484 · Ibm · Bigfix Webui Api App

Name of the Vulnerable Software and Affected Versions: Bigfix WebUI API App versions prior to 14 Description: The issue is related to insufficient validation, allowing an authenticated WebUI user to issue SQL queries via an unparameterized SQL query. Recommendations: For versions prior to 14,...

PT-2023-14773 · Nootheme · Noo Timetable

Name of the Vulnerable Software and Affected Versions: NooTheme Noo Timetable plugin versions = 2.1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-3943 · Oracle · Jd Edwards Enterpriseone Tools

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Tools versions prior to 9.2.7.4 Description: The issue allows an unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a...

PT-2023-22561 · Prestashop · Payplug

Name of the Vulnerable Software and Affected Versions: PrestaShop module payplug versions 3.6.0 through 3.7.1 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the ajax.php front controller, which is vulnerable to SQL injection attacks...

PT-2023-3992 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server and Data Center versions 8.0.0 through 8.3.1 Atlassian Confluence Server and Data Center versions prior to 8.3.2 and 8.4.0 Description: The issue is related to insufficient input validation, allowing a remote...

PT-2023-25296 · Iagona · Iagona Scrutisweb

Name of the Vulnerable Software and Affected Versions: Iagona ScrutisWeb versions 2.1.37 and prior Description: The issue is related to a cryptographic vulnerability. This vulnerability could allow an unauthenticated user to decrypt encrypted passwords into plaintext. Recommendations: For Iagona...

PT-2023-25848 · Wolfssl · Wolfssl

Name of the Vulnerable Software and Affected Versions: wolfSSL affected versions not specified Description: When a TLS 1.3 client connects to a malicious server without receiving a PSK pre shared key extension or a KSE key share extension, it uses a default predictable buffer for the IKM Input...

PT-2023-19157 · WordPress · Premmerce

Name of the Vulnerable Software and Affected Versions: Premmerce plugin versions = 1.3.17 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application tha...

PT-2023-3709 · Unknown · Easyappointments

Name of the Vulnerable Software and Affected Versions: easyappointments versions prior to 1.5.0 Description: The issue is related to improper access control in the easyappointments application, which can allow a remote attacker to gain unauthorized access to restricted functions. This is due to a...

PT-2023-4189 · Ibm +3 · Ibm Sdk +4

Name of the Vulnerable Software and Affected Versions: IBM SDK, Java Technology Edition versions 7.1.5.18 through 8.0.8.0 Description: The issue is related to an unsafe deserialization flaw in the Java Technology Edition, which could allow a remote attacker to execute arbitrary code on the system...

PT-2023-22326

Name of the Vulnerable Software and Affected Versions Oliva Expertise EKS versions prior to 1.2 Description The issue allows for authentication bypass by primary weakness, enabling the collection of data as provided by users. Recommendations For versions prior to 1.2, update to a version that...