kernel: md: Replace snprintf with scnprintf

In the Linux kernel, the following vulnerability has been resolved: md: Replace snprintf with scnprintf Current code produces a warning as shown below when total characters in the constituent block device names plus the slashes exceeds 200. snprintf returns the number of characters generated from...

FreeBSD : Gitlab -- Vulnerability (4a08a4fb-f152-11ed-9c88-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4a08a4fb-f152-11ed-9c88-001b217b3468 advisory. - An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7,...

CVE-2023-2181

An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would not be visible during review in the UI...

UBUNTU-CVE-2023-2181

An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would not be visible during review in the UI...

CVE-2023-2181

An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would not be visible during review in the UI...

PT-2023-18345 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 15.9.8 GitLab versions 15.10.0 through 15.10.7 GitLab versions 15.11.0 through 15.11.3 Description: A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would...

CVE-2023-2181

GitLab vulnerability CVE-2023-2181 affects all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. An attacker could abuse the git feature refs/replace to smuggle content into a merge request, which would not be visible during UI review. This is caused by improper handling...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab versions prior to 15.9.8, 15.10.0...

CVE-2023-2181

Removed by vendor...

Gitlab -- Vulnerability

Gitlab reports: Smuggling code changes via merge requests with refs/replace...

kernel: wifi: mac80211: fix use-after-free in chanctx code

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free in chanctx code In ieee80211vifusereservedcontext, when we have an old context and the new context's replacestate is set to IEEE80211CHANCTXREPLACENONE, we free the old context in...

WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software CM On Demand Search And Replace Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-28749 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 611848008c27 Credits Abd...

CVE-2023-30858

The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2nd degree polynomial inefficiency, leading to a delayed response given a big payload. The issue has been patched in 0.3.0. As a workaround, avoid using the...

WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software CM On Demand Search And Replace Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-31228 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b6d0be7508ff Credits Abdi...

Enable Media Replace Plugin for WordPress < 4.0.2 Arbitrary File Upload

The WordPress Enable Media Replace Plugin installed on the remote host is affected by a arbitrary file upload vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

postgresql: Extension scripts replace objects not belonging to the extension.

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the objec...

CVE-2023-0975

A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, to replace one of the Agent’s executables before it can be executed. This allows the user to elevate their permissions...

WordPress Easy Media Replace Plugin <= 0.1.3 is vulnerable to Arbitrary File Deletion

Software Easy Media Replace Type Plugin Vulnerable versions = 0.1.3 Fixed in 0.2.0 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2022-46850 Patch priority Medium CVSS severity Medium 8.7 Developer Claim ownership PSID 321ee0c96fa7 Credits Jeong Seong Ho...

Easy Media Replace < 0.2.0 - Author+ File Deletion

The plugin does not validate path of files to be deleted, which could allow users with a role of Author and above to delete files with an allowed extension...

CVE-2023-25146

A security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarantine a file, delete the original folder and replace with a junction to an arbitrary location, ultimately leading to an arbitrary file dropped to an arbitrary location. Please note...