PT-2023-36209 · Go +1 · Go +1

Name of the Vulnerable Software and Affected Versions: prometheus-ha cluster exporter affected versions not specified Description: The issue is related to a security concern in the go 1.20 release, which is addressed by rebuilding the prometheus-ha cluster exporter package with this security...

avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields

Summary Some avo fields are vulnerable to XSS when rendering html based content. Details During the analysis of the web application, a rendered field was discovered that did not filter JS / HTML tags in a safe way and can be abused to execute js code on a client side. The trix field uses the trix...

CVE-2023-25741

When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipped in 109 and caused web compatibility problems as well as this security concern, so the behavior was disabled until further review. This vulnerability affects Firefox 110...

CVE-2023-25741

When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipped in 109 and caused web compatibility problems as well as this security concern, so the behavior was disabled until further review. This vulnerability affects Firefox 110...

PT-2023-16778 · Silicon · Gecko Platform Sdk

Name of the Vulnerable Software and Affected Versions: Silicon Labs Gecko Platform SDK versions 4.2.1 and earlier Description: The issue arises from the compiler removal of buffer clearing in the sli se driver key agreement function, leading to key material duplication to RAM. This results in a...

PT-2023-36162 · Conmon · Conmon

Name of the Vulnerable Software and Affected Versions: conmon affected versions not specified Description: The issue is related to the conmon package, which has been rebuilt with the go 19.9 secure release to address a security concern. Recommendations: At the moment, there is no information abou...

PT-2023-36160 · Ignition · Ignition

Name of the Vulnerable Software and Affected Versions: ignition affected versions not specified Description: The issue is related to a security concern that has been addressed by rebuilding the package with the go 19.9 secure release. Recommendations: At the moment, there is no information about ...

PT-2025-25885 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A memory leak issue has been identified in the Linux kernel, specifically in the openvswitch component. The issue occurs when the ovs dp cmd new function fails during datapath creation...

PT-2023-36157 · Unknown · Prometheus-Ha Cluster Exporter

Name of the Vulnerable Software and Affected Versions: prometheus-ha cluster exporter affected versions not specified Description: The issue is related to a security concern that has been addressed by rebuilding the package with the go 19.9 secure release. Recommendations: At the moment, there is...

MAL-2023-1252 Malicious code in not-a-real-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 784465edafb8e247845de45eb1f9c8d0b19b03706e98e861f1a570732d66cba5 The OpenSSF Package Analysis project identified 'not-a-real-dep' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Vulnerability in Keccak Function Used for Equality Check in equals() Function.

Lines of code Vulnerability details Impact The BytesUtils library is using Keccak function to check for equality in the equals function. This is a security concern since the Keccak function is vulnerable to hash collisions, which could allow a malicious user to create an input that matches a...

DEBIAN-CVE-2023-30402

YASM v1.3.0 was discovered to contain a heap overflow via the function handledotlabel at /nasm/nasm-token.re. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code...

Ruby on Rails: Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability.

An incorrect handling of certain characters passed to the redirection functionality in Rails could lead to a single-click XSS vulnerability. This vulnerability allowed an attacker to control the href attribute in the HTML response and serve an XSS payload by preventing the redirect. The...

CVE-2023-30630

Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. NOTE: Some third parties have indicated the fix in 3.5 does not adequately address the vulnerability. The argument is that the proposed...

PT-2023-20214 · Basercms · Basercms

Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 4.7.5 Description: There is a Remote Code Execution RCE Vulnerability in the management system of baserCMS. This issue allows for remote code execution, which is a serious security concern. The estimated number of...

K20445457: iControl REST vulnerability CVE-2019-6620

Security Advisory Description Undisclosed iControl REST worker vulnerable to command injection for an Administrator user. CVE-2019-6620 Impact BIG-IP and BIG-IQ This vulnerability may bypass Appliance mode security by allowing the execution of arbitrary bash commands. In non-Appliance mode...

Moodle 3.8.x < 3.8.8 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.5.x prior to 3.5.17, 3.8.x prior to 3.8.8, 3.9.x prior to 3.9.5 or 3.10.x prior to 3.10.2. It is, therefore, affected by multiple vulnerabilities: - A stored Cross-Site Scripting XSS vulnerability attack due to the lack of sanitization of th...

CVE-2023-25741

The Mozilla Foundation Security Advisory: When dragging and dropping an image cross-origin, the image size could potentially be leaked. This behavior was shipped in 109 and caused web compatibility problems as well as this security concern, so the behavior was disabled until further review...

CVE-2023-25741

When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipped in 109 and caused web compatibility problems as well as this security concern, so the behavior was disabled until further review. This vulnerability affects Firefox 110...

PT-2023-18580 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The issue was initially considered but further investigation showed it was not a security issue. It was withdrawn by its CNA. Recommendations: At the moment, there is no...