Security Bulletin: IBM InfoSphere Information Server is vulnerable to cross-site scripting (CVE-2023-33843)

Summary A cross-site scripting vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-33843 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t...

Security Bulletin: IBM InfoSphere Information Server is affected by an information disclosure vulnerability (CVE-2023-50955)

Summary An information disclosure vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-50955 DESCRIPTION: IBM InfoSphere Information Server could allow an authenticated privileged user to obtain the absolute path of the web server installation whi...

SUSE-SU-2024:0548-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.42.5 bsc1219604: - CVE-2024-23222: Fixed processing maliciously crafted web content that may have led to arbitrary code execution bsc1219113. - CVE-2024-23206: Fixed fingerprint user via maliciously crafted webpages...

CVE-2023-52433 netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetrbtree: skip sync GC for new elements in this transaction New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an alrea...

sudo: Fix of CVE-2023-42465

CVE-2023-42465: make sudo less vulnerable to ROWHAMMER attacks...

CLSA-2024-1708427829 Fix CVE(s): CVE-2024-25062

SECURITY UPDATE: Use-after-free in xmlValidatePopElement - debian/patches/CVE-2024-25062.patch: Fix use-after-free if XML Reader with DTD validation and XInclude expansion by not expanding XIncludes when backtracking - CVE-2024-25062...

PT-2024-17199 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Filterable Gallery Widget due to insufficient input sanitization an...

PT-2024-21319 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.4.3.13 Liferay DXP 7.4 before update 10 Liferay DXP 7.3 before update 4 Liferay DXP 7.2 before fix pack 17 Liferay DXP older unsupported versions Liferay Portal older unsupported versions Description:...

Cross-site scripting (XSS) in the dynamic file uploads

Impact The dynamic file upload feature is subject to potential XSS attach in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to chang...

CVE-2024-26134 CBOR2 decoder has potential buffer overflow

cbor2 provides encoding and decoding for the Concise Binary Object Representation CBOR RFC 8949 serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a...

CVE-2024-25634

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The attacker can use a specially crafted request to receive the e-mail log sent by other events. Version 2.0-M4-2402 fixes this issue...

MGASA-2024-0043 Updated postgresql15 and postgresql13 packages fix a security vulnerability

The updated packages fix a security vulnerability: PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL. CVE-2024-0985...

QNAP QTS Vulnerability in QTS (QSA-24-01)

The version of QNAP QTS installed on the remote host is affected by a vulnerability as referenced in the QSA-24-01 advisory. - An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated use...

Medium: vim

Issue Overview: Vim before 9.0.2142 has a stack-based buffer overflow because didsetlangmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions. CVE-2024-22667 Affected Packages: vim Issue Correction: Run dnf update vim --releasever...

SUSE-SU-2024:0522-1 Security update for postgresql13

This update for postgresql13 fixes the following issues: Upgrade to 13.14: - CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY bsc1219679...

PT-2024-3161 · WordPress · Analytify

Name of the Vulnerable Software and Affected Versions: Analytify – Google Analytics Dashboard For WordPress versions up to, and including, 5.2.1 Description: The issue is related to a missing capability check on the wpa check authentication function, which allows unauthorized modification of data...

QNAP QTS / QuTS hero Vulnerability in QTS, QuTS hero (QSA-23-47)

The version of QNAP QTS / QuTS hero installed on the remote host is affected by a vulnerability as referenced in the QSA-23-47 advisory. - An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to...

CVE-2023-48229

Summary of CVE-2023-48229 (Contiki-NG) : An out-of-bounds write exists in the 802.15.4 radio driver for nRF platforms within Contiki-NG. The issue arises in the read_frame path of arch/cpu/nrf/net/nrf-ieee-driver-arch.c, where payload length validation is incomplete: while the length is checked a...

CVE-2024-23653 affecting package moby-engine for versions less than 20.10.27-3

CVE-2024-23653 affecting package moby-engine for versions less than 20.10.27-3. A patched version of the package is available...

CVE-2021-44716 affecting package prometheus-node-exporter for versions less than 1.3.1-24

CVE-2021-44716 affecting package prometheus-node-exporter for versions less than 1.3.1-24. A patched version of the package is available...