Security Bulletin: Multiple Vulnerabilities in Apache HttpClient, HttpComponents and HttpCommons affect IBM Engineering Lifecycle Optimization - Publishing

Summary There are multiple vulnerabilities in Apache HttpClient, HttpComponents and HttpCommons libraries. This has been addressed. Vulnerability Details CVEID:CVE-2015-5262 DESCRIPTION: Apache Commons is vulnerable to a denial of service, caused by the failure to apply a configured connection...

PT-2023-25151 · Unknown · Conacwin Cb

Name of the Vulnerable Software and Affected Versions: ConacWin CB versions 3.8.2.2 and earlier Description: The issue is a relative path traversal vulnerability that could allow an attacker to perform an arbitrary download of files from the system via the Download file parameter. Recommendations...

PT-2023-5676 · Red Hat · Openshift

Name of the Vulnerable Software and Affected Versions: OpenShift affected versions not specified Description: A privilege escalation flaw was found in the node restriction admission plugin of the Kubernetes API server of OpenShift. A remote attacker who modifies the node role label could steer...

PT-2023-13468 · Tcman Gim · Tcman Gim

Name of the Vulnerable Software and Affected Versions: TCMAN GIM version 8.0.1 Description: The issue is related to a SQL injection vulnerability via the SqlWhere parameter inside the BuscarESM function. This could allow a remote attacker to directly interact with the database. Recommendations: F...

PT-2023-5790 · Acronis · Acronis Agent

Name of the Vulnerable Software and Affected Versions: Acronis Agent versions before build 29258 Description: The issue is related to sensitive information disclosure and manipulation due to missing authorization. This could allow an attacker to gain unauthorized access to protected information...

PT-2023-29223 · Zope · Zope

Name of the Vulnerable Software and Affected Versions: Zope versions prior to 4.8.11 Zope versions prior to 5.8.6 Description: Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the...

PT-2023-22938 · Unknown · S Assistant

Name of the Vulnerable Software and Affected Versions: SAssistant versions prior to 8.7 Description: The issue allows local attackers to access backup data in SAssistant due to an improper preservation of permissions. This enables unauthorized access to sensitive information. Recommendations: For...

PT-2023-24026 · Nxlog · Nxlog Manager

Name of the Vulnerable Software and Affected Versions: NXLog Manager version 5.6.5633 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows an attacker to eliminate roles within the platform by sending a specifically crafted query to the server. This is due to the...

PT-2023-20804 · Jorani · Jorani

Name of the Vulnerable Software and Affected Versions: Jorani version 1.0.0 Description: An SQL Injection issue has been found, allowing an authenticated remote user with low privileges to send queries with malicious SQL code on the "/leaves/validate" path and the id parameter. This enables the...

PT-2023-27660 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.19 Description: The issue is related to a Buffer Overflow, where the Index parameter does not verify the length. This can lead to potential exploitation. No information is provided about the estimated number of...

PT-2023-26815 · Woocommerce · Thedotstore Banner Management For Woocommerce

Name of the Vulnerable Software and Affected Versions: theDotstore Banner Management For WooCommerce plugin versions = 2.4.2 Description: A Cross-Site Request Forgery CSRF issue affects the plugin, allowing unauthorized actions to be performed on behalf of a user without their knowledge...

PT-2023-27866 · Unknown · Buildfail Localize Remote Images

Name of the Vulnerable Software and Affected Versions: Buildfail Localize Remote Images plugin versions 1.0.9 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-5990 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-beta1 and earlier Adobe Commerce versions 2.4.6-p2 and earlier Adobe Commerce versions 2.4.5-p4 and earlier Adobe Commerce versions 2.4.4-p5 and earlier Description: The issue is related to the lack of protection...

PT-2023-27051 · Prestashop +1 · Theme Volty Cms Testimonial Module +1

Name of the Vulnerable Software and Affected Versions: Theme Volty CMS Testimonial module for PrestaShop versions up to 4.0.1 Description: The issue is related to improper neutralization of SQL parameters in the Theme Volty CMS Testimonial module for PrestaShop, allowing a guest to perform SQL...

CVE-2023-42132

FD Application Apr. 2022 Edition Version 9.01 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker...

CVE-2023-42132

FD Application Apr. 2022 Edition Version 9.01 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker...

PT-2023-29031 · Netis · Netis N3Mv2

Name of the Vulnerable Software and Affected Versions: Netis N3Mv2 version 1.0.1.865 Description: The issue is related to a command injection vulnerability. This vulnerability can be exploited via a crafted payload, specifically through the Hostname parameter within the WAN settings...

ASB-A-270368476

In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-28932 · Unknown · Oscommerce

Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript via the title parameter in the "/admin/admin-menu/add-submit" endpoint. This can lead to...

PT-2023-28952 · Unknown · Oscommerce

Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript through the zone name parameter, potentially leading to unauthorized execution of script...