SUSE-SU-2023:2544-1 Security update for kubernetes1.24

This update for kubernetes1.24 fixes the following issues: - CVE-2023-2727: Fixed bypassing policies imposed by the ImagePolicyWebhook admission plugin bsc1211630. - CVE-2023-2728: Fixed bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin bsc1211631...

CVE-2023-35853

In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section...

DSA-5432-1 xmltooling - security update

Bulletin has no description...

CVE-2023-34660

jjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface...

Magento Open Source affected by Improper Input Validation

Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to leak another user's data. Exploitation of this issue...

genson vulnerable to stack exhaustion

An issue was discovered genson through 1.6 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures...

GHSA-P4C9-X742-QH8C pbjson vulnerable to stack exhaustion

An issue was discovered pbjson through 0.4.0 allows attackers to cause a denial of service or other unspecified impacts via a crafted object that uses cyclic dependencies...

CVE-2023-24936

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability...

CVE-2023-34623

An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies...

DSA-5426-1 owslib - security update

Bulletin has no description...

CVE-2023-26965

loadImage in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image...

CVE-2023-34867

Jerryscript 3.0 commit 05dbbd1 was discovered to contain an Assertion Failure via the ecmapropertyhashmapcreate at jerry-core/ecma/base/ecma-property-hashmap.c...

CVE-2023-2807 Authentication bypass in password reset process

Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication. This issue affects PandoraFMS v771 and prior versions on all platforms...

WordPress WP Mail Catcher Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Mail Catcher Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3080 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 4c3adbc78628 Credits Alex Thomas Required...

OSV-2023-471 Heap-buffer-overflow in H5FS__sinfo_serialize_node_cb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59695 Crash type: Heap-buffer-overflow WRITE 1 Crash state: H5FSsinfoserializenodecb H5SLiterate H5FScachesinfoserialize...

DLA-3450-1 ruby2.5 - security update

Bulletin has no description...

CVE-2022-25834

In Percona XtraBackup PXB through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands...

CVE-2023-33601

An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2023-2132

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted...

CVE-2023-28162

While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash. This vulnerability affects Firefox 111, Firefox ESR 102.9, and Thunderbird 102.9...