SUSE CVE-2023-46137

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, th...

PT-2023-31581 · Callrail · Callrail Phone Call Tracking Plugin

Name of the Vulnerable Software and Affected Versions: CallRail Phone Call Tracking plugin for WordPress versions up to, and including, 0.5.2 Description: The issue arises from insufficient input sanitization and output escaping on the form id user-supplied attribute in the 'callrail form'...

Juniper Junos OS Vulnerability (JSA73151)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA73151 advisory. - An Exposure of Sensitive Information vulnerability in the ' CVE-2023-44187 Note that Nessus has not tested for this issue but has instead relied only on the application's...

PT-2023-32344 · Unknown · Flusity-Cms

Name of the Vulnerable Software and Affected Versions: flusity CMS affected versions not specified Description: A problematic issue has been found in flusity CMS, affecting the loadPostAddForm function of the file core/tools/posts.php. The manipulation of the edit post id argument leads to...

andrea-glaser.de Improper Access Control vulnerability OBB-3765950

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for Code Injection in Utoronto Pcrs

CVE-2023-46404 PCRShttps://mcs.utm.utoronto.ca/pcrs/pcrs/...

Attackers Exploit VMware’s Aria Operations for Logs Vulnerability

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A critical authentication bypass vulnerability CVE-2023-34051 in VMware Aria Operations for Logs allows remote code execution with root privileges under certain conditions, raising concerns for...

PT-2023-29921 · Zitadel · Zitadel

Name of the Vulnerable Software and Affected Versions: ZITADEL versions prior to 2.38.2 ZITADEL versions prior to 2.39.2 Description: ZITADEL is an identity infrastructure management system where users can upload their own avatar image using various image types, including SVG. SVG can include...

twisted.web has disordered HTTP pipeline response

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, th...

DEBIAN-CVE-2023-46137

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, th...

CVE-2023-46233

crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm...

Design/Logic Flaw

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publicly can be vulnerable to remote code execution, allowing attackers to run malicious code on the server. This issue has been patched in...

Design/Logic Flaw

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, th...

XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled

Impact When document names are validated according to a name strategy disabled by default, XWiki is vulnerable to a reflected XSS attack in the page creation form. To reproduce, make sure that "Validate names before saving" is enabled in the administration under "Editing" - "Name strategies" and...

GHSA-GH64-QXH5-4M33 org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents

Impact When a document has been deleted and re-created, it is possible for users with view right on the re-created document but not on the deleted document to view the contents of the deleted document. Such a situation might arise when rights were added to the deleted document. This can be...

CVE-2023-46233

CVE-2023-46233 affects crypto-js in Crypto-JS prior to 4.2.0. The PBKDF2 implementation uses SHA1 and a fixed iteration count of 1,000, making it far weaker than the 1993 spec and substantially weaker than current standards. Reported impact is high for password protection and signature generation...

CVE-2023-46133

CVE-2023-46133 documents a weakness in CryptoES prior to v2.1.0 where PBKDF2 was configured by default to use SHA-1 with a single iteration (1,000), making it far weaker than the 1993 specification and current standards. This can impact password protection and digital signatures. A patch is avail...

Remote code execution

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In org.xwiki.platform:xwiki-platform-web versions 7.2-milestone-2 until 14.10.12 and org.xwiki.platform:xwiki-platform-web-templates prior to versions 14.10.12 and 15.5-rc-1, it is possible to...

CVE-2023-45136 XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy disabled by default, XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflecte...

CVE-2023-45135 XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In org.xwiki.platform:xwiki-platform-web versions 7.2-milestone-2 until 14.10.12 and org.xwiki.platform:xwiki-platform-web-templates prior to versions 14.10.12 and 15.5-rc-1, it is possible to...