CVE-2023-47342

This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

Medium: golang

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Amazon Linux 2 : golang (ALAS-2024-2388)

The version of golang installed on the remote host is prior to 1.20.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2388 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many...

Medium: golang

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Medium: golang

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

LinkedIn: Employee-only Area Bypass

An improper access control issue allowed unauthorized access to an employee-only area, leading to information disclosure...

CVE-2023-50569

DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2023-50250. Reason: This record is a reservation duplicate of CVE-2023-50250. Notes: All CVE users should reference CVE-2023-50250 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.20-openssl (SUSE-SU-2023:4930-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4930-1 advisory. Update to version 1.20.12.1: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.21-openssl (SUSE-SU-2023:4931-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4931-1 advisory. Update to version 1.21.5.1: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:...

CVE-2023-50459

CVE-2023-50459 corresponds to a Broken Access Control issue in the TYPO3 extension femanager (in2code). The connected advisories identify the vulnerable components as the check_edit_user component (improper access checks) and a missing backend access check, enabling an authenticated frontend user...

CVE-2021-44910

CVE-2021-44910 is described in the NUCLEI template as an information-leak issue in the SpringBlade framework. The root cause is a default SIGN_KEY used for JWT signing, which can be exploited to forge tokens and access sensitive data (e.g., user credentials, password hashes, and logs) within Spri...

CVE-2023-50462

The connected sources confirm CVE-2023-50462 corresponds to an Insecure Direct Object Reference (IDOR) in the TYPO3 extension Content Consent (content_consent). Root cause: the extension fails to verify whether a requested content element identifier is permitted, allowing unauthenticated users to...

CVE-2023-50461

CVE-2023-50461 corresponds to a TYPO3 Direct Mail extension vulnerability. The Direct Mail backend’s Configuration module allows an authenticated backend user to write arbitrary TSConfig for folders configured as Direct Mail, which can lead to Configuration Injection and Arbitrary Code Execution....

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.20 (SUSE-SU-2023:4708-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4708-1 advisory. Update to go1.20.12: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// sche...

CVE-2023-43020

CVE-2023-43020 is evidenced in IBM bulletins as a denial-of-service vulnerability in IBM Db2 (including Db2 Connect Server) when processing a specially crafted query. Affected products span Db2 on Linux/UNIX/Windows (versions 10.5, 11.1, 11.5; Db2 Big SQL is also listed in related bulletins). The...

CVE-2021-26292

The CVE-2021-26292 entry maps to AfterLogic Aurora and WebMail Pro

MGASA-2023-0323 Fix u-boot reading file would overwrite reserved memory error

U-boot would not boot after upgrading to 2023.01 version on RPI 4/CM4 boards. Log would report: - Found EFI removable media binary efi/boot/bootaa64.efi - Reading file would overwrite reserved memory The updated package allows u-boot to load properly bootaa64.efi...

Fix u-boot reading file would overwrite reserved memory error

U-boot would not boot after upgrading to 2023.01 version on RPI 4/CM4 boards. Log would report: - Found EFI removable media binary efi/boot/bootaa64.efi - Reading file would overwrite reserved memory The updated package allows u-boot to load properly bootaa64.efi...

CVE-2023-39120

Nodogsplash is affected by a directory traversal vulnerability (CVE-2023-39120) that also impacts OpenWrt. The issue allows remote attackers to read arbitrary files from the target system and is mitigated by upgrading Nodogsplash to version 5.0.1. The Nuclei template notes the vulnerability and s...

CVE-2023-1434

Odoo prior to 16.0 is vulnerable to CVE-2023-1434 due to an incorrect Content-Type on an API endpoint, enabling Cross-Site Scripting. The NUCLEI template notes the issue affects versions before 16.0 and describes the root cause as a mis-set content type in an API handler. Impactally, successful e...