CVE-2023-46243

XWiki Platform contains a remote code execution vulnerability (CVE-2023-46243) where a user with edit rights on a document can trigger Groovy code execution via a crafted edit URL (e.g., /xwiki/bin/edit//?content={{groovy}}println("Hello"){{/groovy}}&xpage=view). Root cause: the edit action write...

Design/Logic Flaw

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

CVE-2023-46737 affects Cosign, a sigstore signing tool for OCI containers. The root cause is that Cosign loops through all attestations fetched from a remote registry in pkg/cosign.FetchAttestations, allowing an attacker-controlled registry to return a high number of attestations or signatures an...

PT-2025-18852 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the fixed version Description: A use-after-free issue was found in the mptcp listener shutdown path in the Linux kernel. This issue can occur when the msk grace period expires between the last reference count dr...

Updated libsndfile packages fix a security vulnerability

Add upstream patch to fix CVE-2022-33065...

Multiple Cisco Products Snort 3 Access Control Policy Bypass (cisco-sa-ftd-snort3acp-bypass-3bdR2BEh)

According to its self-reported version, Cisco FTD Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

Multiple Cisco Products Snort FTP Inspection Bypass (cisco-sa-snort-ftd-zXYtnjOM) (CSCwd83613)

According to its self-reported version, Cisco FTD Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

Git for Windows < 2.30.7 / 2.31.6 / 2.32.5 / 2.33.6 / 2.34.6 / 2.35.6 / 2.36.4 / 2.37.5 / 2.38.3 / 2.39.1 Multiple Vulnerabilities

The version of Git for Windows installed on the remote host is affect by multiple vulnerabilities, as follows: - Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the...

Multiple Cisco Products Snort FTP Inspection Bypass (cisco-sa-snort-ftd-zXYtnjOM) (CSCwb69096)

According to its self-reported version, Cisco FTD Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

Rocky Linux 8 : Satellite 6.11 Release (Moderate) (RLSA-2022:5498)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5498 advisory. - Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol serve...

CVE-2023-23368 QTS, QuTS hero, QuTScloud

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later...

F5 Networks BIG-IP : Intel CPU vulnerability (K82356391)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K82356391 advisory. Improper buffer restrictions in BIOS firmware for some IntelR Processors may allow a privileged user to potentially...

CVE-2023-41164

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uritoiri is subject to a potential DoS denial of service attack via certain inputs with a very large number of Unicode characters...

F5 Networks BIG-IP : BIG-IP APM portal access vulnerability (K40625021)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K40625021 advisory. - A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP...

F5 Networks BIG-IP : tcpdump vulnerability (K56551263)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.4.1 / 14.1.3.1 / 15.1.3 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K56551263 advisory. The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-...

F5 Networks BIG-IP : SNMPv2 vulnerability (K04463175)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K04463175 advisory. - An SNMP community name is the default e.g. public, null, or missing. CVE-1999-0517 Note that Nessus has not tested fo...

RUSTSEC-2023-0069 sudo-rs: Path Traversal vulnerability

Impact An issue was discovered where usernames containing the . and / characters could result in the corruption of specific files on the filesystem. As usernames are generally not limited by the characters they can contain, a username appearing to be a relative path can be constructed. For exampl...

PT-2023-30259 · Jspxcms · Jspxcms

Name of the Vulnerable Software and Affected Versions: Jspxcms version 10.2.0 Description: There is a Cross Site Scripting XSS issue in the "choose style tree.do" interface of the backend. This affects the ability to securely interact with the system, potentially allowing malicious scripts to be...

Multiple Cisco Products Snort 3 Access Control Policy Bypass (cisco-sa-ftd-snort3acp-bypass-3bdR2BEh)

According to its self-reported version, Cisco ASA Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

pimcore/admin-ui-classic-bundle Unverified Password Change

Impact As old password can be set as new password , it is considered as password policy violation. Pimcore is not enforcing strict password policy which allow attacker to set old password as new password Proof of Concept 1. Go to Admin link 2. login and click on - "User | My Profile". 3. Go to...