WordPress Print, PDF, Email by PrintFriendly Plugin <= 5.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Print, PDF, Email by PrintFriendly Type Plugin Vulnerable versions = 5.5.1 Fixed in 5.5.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25032 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d63fd651e5b7 Credits Abdi...

CVE-2023-44190 Junos OS Evolved: PTX10001, PTX10004, PTX10008, PTX10016: MAC address validation bypass vulnerability

An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded ...

PYSEC-2023-201

vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/id/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version...

CVE-2023-41881 Deleting a collaboration should also delete linked resources

vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources such as tasks from that collaboration should be deleted. This is partly to manage data properly, but also to prevent a potential but unlikely side-effect that affects versions...

CVE-2023-41881

Vantage6 vulnerabilities: When a collaboration is deleted, linked resources (e.g., tasks) are not reliably deleted in versions prior to 4.0.0. This could allow authenticated users in a later-created collaboration to see results from the deleted collaboration in some cases. The issue is fixed in v...

CVE-2023-28635

The CVE-2023-28635 issue affects vantage6 prior to version 4.0.0, where resources named with integers could bypass access controls and allow some users to run algorithms they’re not authorized to. The root cause is a mismatch between resource IDs and names, enabling attackers to exploit numeric i...

[SECURITY] Fedora 38 Update: libcaca-0.99-0.69.beta20.fc38

libcaca is the Colour AsCii Art library. It provides high level functions for color text drawing, simple primitives for line, polygon and ellipse drawing, as well as powerful image to text conversion routines...

PT-2023-28140 · Vantage6 · Vantage6

Name of the Vulnerable Software and Affected Versions: vantage6 versions prior to 4.0.0 Description: vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources, such as tasks from that collaboration, should be deleted to manage data...

Vulnerability fixed in libcurl

There is a vulnerability in the SOCKS5 proxy handshake of libcurl. A malicious party could potentially exploit the vulnerability to cause a crash in the application using libcurl. To perform this attack successfully, several conditions must be met such as using a SOCKS5 proxy, the use of a long...

Juniper Junos OS Vulnerability (JSA73155)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA73155 advisory. - An Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of...

Juniper Junos OS Vulnerability (JSA73168)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA73168 advisory. - An Incorrect Authorization vulnerability in TCP packet processing of Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to bypass intended...

Juniper Junos OS Vulnerability (JSA73530)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA73530 advisory. - A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS allows an adjacent, unauthenticated...

Juniper Junos OS Vulnerability (JSA73163)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA73163 advisory. - An Out-of-Bounds Write vulnerability in the Routing Protocol Daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker...

Patch Tuesday - October 2023

Microsoft is addressing 105 vulnerabilities this October Patch Tuesday, including three zero-day vulnerabilities, as well as 12 critical remote code execution RCE vulnerabilities, and one republished third-party vulnerability. WordPad: zero-day NTLM hash disclosure Another Patch Tuesday, another...

Mars: CVE-█████-35813 in █████

A critical remote code execution vulnerability CVE-█████-35813 affecting multiple Sitecore products through version 10.3 was discovered. The vulnerability was exploited through the sitecorexaml.ashx endpoint using ASP.NET TemplateParser injection, allowing attackers to execute arbitrary code. The...

2023-10 Dynamic Cumulative Update for Windows 11 Version 22H2 for x64-based Systems (KB5031354)

ComponentUpdate: A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft...

smbd allows client access to unix domain sockets

Description The SMB 1/2/3 protocols allow clients to connect to named pipes via the IPC$ Inter-Process Communication share for the process of inter-process communication between SMB clients and servers. Since Samba 4.16.0, Samba internally connects client pipe names to unix domain sockets within ...

Siemens SICAM PAS/PQS

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2023-6171 · Sangfor · Sangfor Next-Gen Application Firewall

Name of the Vulnerable Software and Affected Versions: Sangfor Next-Gen Application Firewall version NGAF8.0.17 Description: The issue allows a remote and unauthenticated attacker to bypass authentication and access administrative functionality. This is achieved by sending HTTP requests with a...

SUSE-SU-2023:4018-1 Security update for go1.20

This update for go1.20 fixes the following issues: - Updated to version 1.20.9 bsc1206346: - CVE-2023-39323: Fixed an arbitrary execution issue during build time due to path directive bypass bsc1215985...