Security Bulletin: IBM InfoSphere Information Server is affected by an information disclosure vulnerability (CVE-2023-35898)

Summary DataStage Flow Designer is an internal component of IBM InfoSphere Information Server. An information disclosure vulnerability in the DataStage Flow Designer was addressed. Vulnerability Details CVEID:CVE-2023-35898 DESCRIPTION: IBM InfoSphere Information Server could allow an authenticat...

CasaOS Gateway vulnerable to incorrect identification of source IP addresses

Unauthenticated attackers can execute arbitrary commands as root on CasaOS instances...

CasaOS contains weak JWT secrets

Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Apache Cassandra (CVE-2023-30601)

Summary A vulnerability in Apache Cassandra used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-30601 DESCRIPTION: Apache Cassandra could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the FQL/Audit log...

Security Bulletin: IBM InfoSphere Information Server is affected by an information disclosure vulnerability (CVE-2023-33857)

Summary An information disclosure vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-33857 DESCRIPTION: IBM InfoSphere Information Server could allow a remote attacker to obtain system information using a specially crafted query that could aid i...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Tomcat (CVE-2023-28708, CVE-2023-24998)

Summary Multiple vulnerabilities in Apache Tomcat used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2023-28708 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by the missing of secure attribute in some...

Security Bulletin: IBM InfoSphere Information Server is affected but not vulnerable to a vulnerability in jose.4j

Summary An information disclosure vulnerability in jose.4j used by InfoSphere Information Server was addressed. Vulnerability Details IBM X-Force ID: 254437 DESCRIPTION: jose.4.j could allow a remote attacker to obtain sensitive information, caused by a chosen ciphertext attack in RSA15. By utili...

Security Bulletin: IBM InfoSphere Information Server is affected by a denial of service vulnerability in Apache Commons FileUpload and Tomcat (CVE-2023-24998)

Summary A denial of service vulnerability in Apache Commons FileUpload and Tomcat affects WebSphere Liberty that is used by IBM InfoSphere Information Server. The vulnerability was addressed. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerab...

GHSA-JQ43-Q8MX-R7MQ SwiftTerm Code Injection vulnerability

Impact Attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands. Credit These...

GHSA-H4VP-69R8-GVJG org.xwiki.platform:xwiki-platform-skin-ui Eval Injection vulnerability

Impact Improper escaping in the document SkinsCode.XWikiSkinsSheet leads to a possible privilege escalation from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code...

Security Bulletin: IBM InfoSphere Information Server is affected but not vulnerable to multiple vulnerabilities in Undertow

Summary Multiple vulnerabilities in Undertow used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2022-1259 DESCRIPTION: Undertow is vulnerable to a denial of service, caused by a potential security issue in flow control over HTTP/2. By sending a...

Evaluate Your Windows Endpoints for Storm-0978 Activity With Qualys Endpoint Security

Summary: On July 11, Microsoft released security bulletins to fix 132 vulnerabilities. With the July Patch Tuesday, Microsoft also remediated six zero-day vulnerabilities. For your quick reference, the following are the zero-day vulnerabilities: 1. CVE-2023-32046 - Windows MSHTML Platform Elevati...

CVE-2023-37462

CVE-2023-37462 affects XWiki Platform (SkinsCode.XWikiSkinsSheet). Connected sources confirm an improper escaping vulnerability that allows an injection vector from a crafted non-existing page to obtain programming rights, enabling execution of arbitrary macros (Groovy, Python) and full wiki cont...

CVE-2023-37275 System logs spoofable in Auto-GPT via ANSI control sequences

Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of color-coded print statements to signify different types of system messages to the user, including messages that are crucial for the user to...

CVE-2023-37274

CVE-2023-37274 affects Auto-GPT prior to 0.4.3. The bug arises in execute_python_code where the basename argument is not sanitized before writing LLM-supplied code to a file, enabling path traversal to overwrite .py files outside the Auto-GPT workspace (e.g., ../../../main.py). This can lead to a...

Design/Logic Flaw

cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been...

CVE-2022-24834

Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support,...

PT-2023-12519 · WordPress · Custom Banners

Name of the Vulnerable Software and Affected Versions: Custom Banners plugin for WordPress versions up to and including 3.2.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the saveCustomFields function. This allows unauthenticated...

GHSA-5652-92R9-3FX9 Decidim Cross-site Scripting vulnerability in the processes filter

Impact The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of...

Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution

Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. Impact A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the state query...