CVE-2023-45024

Best Practical Request Tracker RT 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder...

CVE-2023-41259

Best Practical Request Tracker RT before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call...

CVE-2023-41260

Best Practical Request Tracker RT before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls...

Denial Of Service (DoS)

wabt is vulnerable to Denial of Service DoS. The vulnerability occurs within the CWriter::MangleType function, resulting in a DoS...

OSV-2023-1101 Heap-buffer-overflow in decode_preR13_entities

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63776 Crash type: Heap-buffer-overflow READ 10 Crash state: decodepreR13entities decodepreR13 dwgdecode...

PT-2023-28691 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 8.2.x through 9.5.0.x Description: The issue concerns an improper handling of insufficient permissions in Dell PowerScale OneFS. A low-privileged remote attacker could potentially exploit this to cause informati...

Cisco Firepower Management Center Software Arbitrary File Download Vulnerability

A vulnerability in the file download feature of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system. This vulnerability is due to a lack of input sanitation. An attacker could exploit this vulnerability b...

Insecure Session Management

thorsten/phpmyfaq is vulnerable to Insecure Session Management. The vulnerability exists because the sessions are not securely handled which allows an attacker to perform unauthorized actions...

OSV-2023-1097 Security exception in com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAst

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63766 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAst java.base/java.util.stream.ReferencePipeline$3$1.accept...

CVE-2023-5900 Cross-Site Request Forgery in pkp/pkp-lib

Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16...

CVE-2023-46448

Reflected Cross-Site Scripting XSS vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images...

CVE-2023-46930

GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gfisomfindodidfortrack /afltest/gpac/src/isomedia/mediaodf.c:522:14...

CVE-2023-46256 PX4-Autopilot Heap Buffer Overflow Bug

PX4-Autopilot provides PX4 flight control solution for drones. In versions 1.14.0-rc1 and prior, PX4-Autopilot has a heap buffer overflow vulnerability in the parser function due to the absence of parserbufindex value checking. A malfunction of the sensor device can cause a heap buffer overflow...

PT-2023-9326 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 119.0.6045.105 Description: The issue is related to the Picture in Picture technology in Google Chrome, where a remote attacker can exploit it to spoof the contents of the URL bar using a specially crafted HTML...

PT-2023-32396 · Pkp-Lib · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to insufficient session expiration in the GitHub repository pkp/pkp-lib. Recommendations: For versions prior to 3.3.0-16, update to version 3.3.0-16 or later to resolve...

PT-2023-28763 · Click Studios · Passwordstate

Name of the Vulnerable Software and Affected Versions: Click Studios SA Pty Ltd Passwordstate versions Build 9785 and before Description: A Cross Site Request Forgery vulnerability allows a local attacker to execute arbitrary code via a crafted request. Recommendations: For versions Build 9785 an...

CVE-2023-42803 BigBlueButton Unrestricted File Upload vulnerability

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures...

The vulnerability of the Garbage Collector component in browsers like Firefox and Firefox ESR, as well as in the Thunderbird email client, allows a hacker to trigger a service failure.

The vulnerability of the Garbage Collector component in Firefox and Firefox ESR browsers, as well as in the Thunderbird email client, is related to memory leaks when performing operations on objects. Exploiting this vulnerability can allow an attacker to cause service interruptions...

PT-2023-28990 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.6.12 BigBlueButton versions prior to 2.7.0-rc.1 Description: The issue is related to Server-Side Request Forgery SSRF, which is a bypass of a previously known problem. A patch was applied to disable follow...

The vulnerability of software for managing data storage on Dell EMC PowerEdge MX Dell SmartFabric Storage lies in insufficient validation of arguments passed to commands, allowing an attacker to execute arbitrary commands.

The vulnerability of the software for managing data storage on Dell EMC PowerEdge MX Dell SmartFabric Storage lies in insufficient checking of arguments passed in commands. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...