[20240201] - Core - Insufficient session expiration in MFA management views

The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...

CVE-2023-24023

Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to discovery of the encryption key and live injection, aka BLUFFS...

MAL-2023-8625 Malicious code in @ukncsc/my-ncsc-ui-common-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9535a39a8207d1d902daf4cfaaad312cc4bae19928fa3d2311e2be1f0ec9b027 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2023:4588-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 115.5.0 MFSA 2023-52 bsc1217230 CVE-2023-6204: Out-of-bound memory access in WebGL2 blitFramebuffer CVE-2023-6205: Use-after-free in MessagePort::Entangled CVE-2023-6206: Clickjacking permission prompts using the...

CVE-2023-42366

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the nexttoken function at awk.c:1159...

DLA-3668-1 opensc - security update

Bulletin has no description...

CVE-2023-6293 Prototype Pollution in robinbuschmann/sequelize-typescript

Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6...

SUSE-SU-2023:4544-1 Security update for squid

This update for squid fixes the following issues: - CVE-2023-46728: Remove gopher support bsc1216926. - Fixed overread in HTTP request header parsing bsc1217274...

CVE-2023-49208

scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration...

CVE-2023-47380

Admidio v4.2.12 and below is vulnerable to Cross Site Scripting XSS...

CVE-2023-36013

PowerShell Information Disclosure Vulnerability...

BELL-CVE-2023-5981

Bulletin has no description...

BELL-CVE-2023-48232

Bulletin has no description...

BELL-CVE-2023-48236

Bulletin has no description...

sharp vulnerability in libwebp dependency CVE-2023-4863

Overview sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. Who does this affect? Almost anyone processing untrusted input with versions of sharp prior to 0.32.6. How to resolve...

Improper Control of Generation of Code ('Code Injection')

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature...

WordPress Welcart e-Commerce Plugin < 2.9.6 is vulnerable to PHP Object Injection

Software Welcart e-Commerce Type Plugin Vulnerable versions 2.9.6 Fixed in 2.9.6 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE N/A Patch priority Medium CVSS severity Medium 4.4 Developer Claim ownership PSID dd10708cfd4f Credits WordFence Required privilege Published 15...

CVE-2023-47390

Headscale through 0.22.3 writes bearer tokens to info-level logs...

OSV-2023-1129 UNKNOWN READ in HeifPixelImage::overlay

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63990 Crash type: UNKNOWN READ Crash state: HeifPixelImage::overlay HeifContext::decodeoverlayimage HeifContext::decodeimageplanar...

GHSA-CC4W-3CFF-J8FW Duplicate Advisory: Eclipse IDE XXE in eclipse.platform

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j24h-xcpc-9jw8. This link is maintained to preserve external references. Original Description In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE...