GHSA-8JXC-5F94-22VH Magento Open Source allows Server-Side Request Forgery (SSRF)

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application t...

GHSA-GRC6-R6F8-XJ7C Magento Open Source allows Improper Authorization

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this...

BELL-CVE-2023-42752

Bulletin has no description...

MAL-2023-8376 Malicious code in @momo-miniapp/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6007d4e44cc4c068a9bb068cda01c272f184a9023da891b3f63737a50f814575 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-25081 · Synology · Video Station

Name of the Vulnerable Software and Affected Versions: Video Station versions prior to 5.7.0 Description: A cross-site scripting XSS issue has been reported, potentially allowing authenticated users to inject malicious code via a network. Recommendations: For versions prior to 5.7.0, update to...

MAL-2023-8344 Malicious code in situs-bandar-togel-hadiah-4d-10-juta-terpercaya-hk-sgp-sdy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 476c626f92379b4df2800baa59991b278c3f33426ff69fbd12afb29821810430 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8346 Malicious code in situs-slot-gacor-pragmatic-play-dijamin-menang-tahun-2023 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cd7a331fb814fa537c53d27be98d58490ef24e73e0720abf83775b181ba3501 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DEBIAN-CVE-2023-32724

Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation...

PT-2023-27659 · Tencent · Tencent Enterprise Wechat Privatization

Name of the Vulnerable Software and Affected Versions: Tencent Enterprise Wechat Privatization versions 2.5.x through 2.6.930000 Description: The issue concerns an interface unauthorized access vulnerability in the background of the software. Recommendations: For versions 2.5.x through 2.6.930000...

PT-2023-29352 · Igor Buyanov · Wp Power Stats

Name of the Vulnerable Software and Affected Versions: Igor Buyanov WP Power Stats plugin versions = 2.2.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a we...

PT-2023-29406 · Unknown · Urvanov Syntax Highlighter

Name of the Vulnerable Software and Affected Versions: Fedor Urvanov, Aram Kocharyan Urvanov Syntax Highlighter plugin versions = 2.8.33 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into...

BELL-CVE-2023-5535

Bulletin has no description...

BELL-CVE-2023-4693

Bulletin has no description...

OSV-2023-1002 Heap-buffer-overflow in iasecc_parse_get_tlv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63163 Crash type: Heap-buffer-overflow READ Crash state: iaseccparsegettlv iaseccparsedocp iaseccsdoparsedata...

SUSE-SU-2023:4049-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2023-5341: Fixed a heap use-after-free in coders/bmp.c. bsc1215939...

Improper Sanitization

octoprint is vulnerable to Improper Sanitization. The vulnerability is due to RelEnvironment class in init.py which allows the execution of arbitrary code within the GCODE script feature. This lack of restriction could allow a malicious admin to configure a specially crafted GCODE script through...

CVE-2023-44399 ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting

ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it...

BELL-CVE-2023-43786

Bulletin has no description...

OSV-2023-997 Heap-buffer-overflow in dxf_fixup_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63137 Crash type: Heap-buffer-overflow READ 1 Crash state: dxffixupstring dwgdxfLAYOUTprivate dwgdxfLAYOUT...

Integer Overflow

libtiff.so is vulnerable to Denial of Service DoS. The vulnerability is due to raw2tiff.c which allows an attacker to parse a crafted TIFF image, resulting in in a Heap Buffer Overflow...