GHSA-Q764-G6FM-555V Path traversal in spotipy

Summary If a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. Details The code Spotipy uses to parse URIs and URLs accepts user data too liberally which allows a malicious user to insert arbitrary characters...

PT-2023-12450 · Unknown · Onlyoffice

Name of the Vulnerable Software and Affected Versions: ONLYOFFICE versions prior to the version released after 2021-11-08 Description: The issue concerns a Cross Site Scripting XSS problem. The "macros" feature of the document editor in ONLYOFFICE allows malicious cross site scripting payloads to...

PT-2023-14706 · Hundredrabbits · Hundredrabbits Left

Name of the Vulnerable Software and Affected Versions: Hundredrabbits Left version 7.1.5 Description: A cross site scripting XSS issue allows attackers to execute arbitrary code via the meta tag. Recommendations: For version 7.1.5, update to a newer version that contains a fix for this issue...

PT-2023-14798 · Opentext · Opentext Content Suite Platform

Name of the Vulnerable Software and Affected Versions: OpenText Content Suite Platform version 16.2.19.1803 Description: An issue was discovered where the action xmlexport accepts the parameter requestContext. If this parameter is present, the response includes most of the HTTP headers sent to th...

PT-2023-18575 · Ibm · Ibm Robotic Process Automation For Cloud Pak

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation for Cloud Pak versions 20.12.0 through 21.0.4 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

PT-2023-33585 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.17 Description: The issue is related to the pnode functionality, specifically the termination at peers of the source. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

PT-2023-33094 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.13 Description: The issue concerns a potential skb leak in the greth init rings function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior...

PT-2023-33211 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.83 Description: The issue is related to a potential security vulnerability in the Bluetooth functionality. It is noted that the actual impact and attack plausibility have not yet been proven. The problem w...

PT-2023-33510 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.18 Description: The issue is related to a use-after-free UAF problem due to reference count races when releasing resources. The actual impact and potential for attack have not been fully determined...

PT-2023-33492 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.19 through v6.0.18 Description: A memory leak issue was discovered when freeing IOTLBs. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions v5.19 through...

PT-2023-33160 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v3.13 through v6.0.11 Description: A potential use-after-free issue has been identified. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v3.13 and is fixed in Linu...

PT-2023-33480 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.19 Description: The issue concerns the execution of long tasks when adding or deleting entries in the netfilter ipset. The actual impact and attack plausibility have not yet been proven. Recommendations: Fo...

PT-2023-33268 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 4.8 through 5.15.81 Description: The issue concerns an out-of-bounds read in the afe4404 read|write raw functions. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2023-18594 · Zoho · Zoho Manageengine Exchange Reporter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Exchange Reporter Plus versions prior to 5708 Description: The issue allows attackers to conduct XXE XML External Entity attacks. This type of attack occurs when an application parses XML input that contains malicious extern...

PT-2023-33399 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.269 Description: The issue is related to a potential security vulnerability in the Bluetooth functionality. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2023-33774 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.16 Description: A potential issue exists in the RDMA/rxe component, specifically in the rxe qp do cleanup function, where a NULL pointer dereference can occur when socket creation fails. The actual impact a...

PT-2023-33366 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.227 Description: The issue concerns a problem with page table retraction in the Linux Kernel, specifically in the mm/khugepaged component. The actual impact and potential for attack have not been proven yet...

PT-2023-1242 · Oracle · Oracle Collaborative Planning +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Installation component of Oracle Collaborative Planning, part of the Oracle E-Business Suite. This can allow a...

PT-2023-33201 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.83 Description: A memory leak issue exists in the sja1105 setup devlink regions function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prio...

PT-2023-33130 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.13 Description: The issue is related to the xen/netback component, where protocol headers may fall in the non-linear area. The actual impact and attack plausibility have not yet been proven. Recommendations...