CVE-2023-47636 Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle

The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page...

Low: ecs-init

Issue Overview: No CVE associated with this advisory Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.2.20231113 or dnf update --advisory ALAS2023-2023-434 --releasever 2023.2.20231113 to update your system. More information on how to update your system can ...

CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CVE-2023-45805 Trojan Lockfilein pdm

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CVE-2023-40184 Improper handling of session establishment errors in xrdp

xrdp is an open source remote desktop protocol RDP server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The authstartsession function can return non-zero 1 value on, e.g., PAM error which may result in in session...

Important: nghttp2

Issue Overview: Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to...

CVE-2023-37477

1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger...

Cross site scripting

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting XSS. Since the Export Chat feature...

CVE-2023-37259 Cross site scripting in Export Chat feature

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting XSS. Since the Export Chat feature...

CVE-2023-37275 System logs spoofable in Auto-GPT via ANSI control sequences

Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of color-coded print statements to signify different types of system messages to the user, including messages that are crucial for the user to...

SAMSUNG Mobile devices 缓冲区错误漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A buffer error vulnerability exists in Samsung Mobile SMR Jul-2023 Release 1 prior to Release 1, which stems from a stack out-of-bounds write issue in...

OPENSUSE-SU-2023:0161-1 Security update for libjxl

This update for libjxl fixes the following issues: Update to release 0.8.2 CVE-2023-35790: Fix an integer underflow bug in patch decoding. bsc1212492...

SUSE: Security Advisory (SUSE-SU-2023:2571-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-24599 · Unknown · Notation-Go

Name of the Vulnerable Software and Affected Versions: notation versions prior to v1.0.0-rc.6 Description: An attacker who has compromised a registry can cause users to verify the wrong artifact. This issue allows an attacker to lead a user into verifying the wrong artifact if they control or...

Design/Logic Flaw

Ombi is an open source application which allows users to request specific media from popular self-hosted streaming servers. Versions prior to 4.38.2 contain an arbitrary file read vulnerability where an Ombi administrative user may access files available to the Ombi server process on the host...

SUSE CVE-2006-6772

Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name CN field of an SSL certificate associated with an https URL...

bumsys 代码问题漏洞

bumsys is an open source project called Business Management System by unilogies individual developers. A code issue vulnerability exists in versions prior to bumsys v1.0.3-beta, which stems from the fact that it allows an attacker to upload dangerous types of files without restriction...

Froxlor 注入漏洞

Froxlor is a lightweight server management software from the Froxlor team. An injection vulnerability exists in versions prior to Froxlor 2.0.0-beta1, which stems from parameter injection...

dotnet7.0 security, bug fix, and enhancement update

7.0.100-0.4.rc2.0.1 - Set TargetRid based on os release major version, add OL arm64 RuntimeIdentifier Orabug: 34671152 7.0.100-0.4.rc2 - Enable ppc64le builds - Related: RHBZ2134642 7.0.100-0.3.rc2 - Update to .NET 7 RC 2 - Resolves: RHBZ2134642...

Intel XMM 缓冲区错误漏洞

Intel XMM is a family of 4G LTE, LTE Advanced, LTE Advanced Pro and 5G modems from Intel Corporation USA. A security vulnerability exists in the Intel XMM 7560 Modem software prior to version M27560R01.2146.00, which stems from incorrect buffer restrictions in the modem software and could allow a...