PT-2023-4224 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.5 Description: The issue is related to insufficient access control in a component of the macOS operating system, which may allow an attacker to gain unauthorized access to protected information. An app may be able t...

PT-2023-12262 · Unknown · Deskpro Support Desk

Name of the Vulnerable Software and Affected Versions: Deskpro Support Desk version 2021.21.6 Description: A Server Side Request Forgery issue allows attackers to execute arbitrary code via a crafted URL. Recommendations: For Deskpro Support Desk version 2021.21.6, update to a newer version that...

PT-2023-25132 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: Ivanti AntiVirus Product versions prior to 7.9.1.285 Description: An out-of-bounds write vulnerability on Windows operating systems causes the Ivanti AntiVirus Product to crash. Recommendations: Update to Ivanti AV Product version 7.9.1.285 o...

PT-2023-7643 · Adobe · Prelude

Name of the Vulnerable Software and Affected Versions: Adobe Prelude versions 22.6 and earlier Description: The issue is related to an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigatio...

CVE-2023-3072 Nomad ACL Policies without Label are Applied to Unexpected Resources

HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11...

PT-2023-24131 · Hashicorp +1 · Hashicorp Nomad +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise versions 0.11.0 through 1.5.6 HashiCorp Nomad and Nomad Enterprise version 1.4.1 Description: A vulnerability in the HTTP search API can reveal names of available CSI plugins to unauthenticated users or...

Medium: zstd

Issue Overview: In zstd, supplying an empty string as an argument to either --output-dir-flat or --output-dir-mirror may cause a buffer overrun. CVE-2022-4899 Affected Packages: zstd Issue Correction: Run dnf update zstd --releasever 2023.1.20230719 or dnf update --advisory ALAS2023-2023-244...

PT-2023-25838 · Avaya · Avaya Aura Device Services

Name of the Vulnerable Software and Affected Versions: Avaya Aura Device Services versions 8.1.4.0 and earlier Description: An OS command injection issue was found in the Avaya Aura Device Services Web application, potentially allowing remote code execution as the Web server user via a malicious...

JVN#44726469: Improper restriction of XML external entity references (XXE) in XBRL data create application

XBRL data create application provided by Financial Services Agency improperly restricts XML external entity references XXE CWE-611. Impact By processing a specially crafted XBRL file, arbitrary files on the system may be read by an attacker. Solution Update the Software Update the software to the...

PT-2023-3712 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 115.0.5790.98 Description: The issue is related to an inappropriate implementation in Web API Permission Prompts in Google Chrome, which may allow a remote attacker to obfuscate security UI via a crafted HTML...

PT-2023-3697 · Oracle · Application Express Administration

Name of the Vulnerable Software and Affected Versions: Application Express Administration versions 18.2 through 22.2 Description: The issue is related to insufficient input validation in the Application Express Administration product of Oracle Application Express. It allows an unauthenticated...

PT-2023-3938 · Oracle · Graalvm Enterprise Edition +1

Name of the Vulnerable Software and Affected Versions: Oracle GraalVM Enterprise Edition versions 21.3.6, 22.3.2 Oracle GraalVM for JDK versions 17.0.7, 20.0.1 Description: The issue is related to errors in processing input data in the GraalVM Compiler component of Oracle GraalVM Enterprise Editi...

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger...

GHSA-FJ8F-56WC-Q36R rabbitmq-connector plugin module in Apache EventMesh platforms allows attackers to send controlled message

CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh incubating V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via rabbitmq messages. Users can use the code under the master...

SUSE-SU-2023:2846-1 Security update for go1.20

This update for go1.20 fixes the following issues: go was updated to version 1.20.6 bsc1206346: - CVE-2023-29406: Fixed insufficient sanitization of Host header in net/http bsc1213229...

PT-2023-25604 · WordPress · Woocommerce Shipping Multiple Addresses

Name of the Vulnerable Software and Affected Versions: WooCommerce Shipping Multiple Addresses plugin versions prior to 3.8.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-22319 · Origin · Ats Pro

Name of the Vulnerable Software and Affected Versions: Origin Software ATS Pro versions prior to 20230714 Description: The issue allows for authentication abuse and bypass through a user-controlled key, enabling unauthorized access. Recommendations: For versions prior to 20230714, update to a...

PT-2023-18617 · WordPress · Mr.Vibe Vslider Multi Image Slider

Name of the Vulnerable Software and Affected Versions: Mr.Vibe vSlider Multi Image Slider for WordPress plugin versions = 4.1.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web applicatio...

PT-2023-21246 · Sajjad Hossain · Wp Reroute Email

Name of the Vulnerable Software and Affected Versions: Sajjad Hossain WP Reroute Email plugin versions = 1.4.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on ...

PT-2023-25722 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series versions 20.1R1 and later versions Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series versions 20.2 through 20.2R3-S6 Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series...