RUSTSEC-2024-0004 `cosmwasm` is unmaintained

The crate cosmwasm is not used anymore since spring 2020. The functionality was split in multiple different crates, such as the standard library cosmwasm-std and the virtual machine cosmwasm-vm. An overview can be found in the cosmwasm repository. If you have this crate in your dependency tree,...

FusionPBX vulnerable to cross-site scripting

Overview FusionPBX contains a stored cross-site scripting vulnerability CWE-79. Satoshi Horikoshi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may be executed on the web browser of the...

JVN#67215338: FusionPBX vulnerable to cross-site scripting

FusionPBX contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is logging in to the product. Solution Update the software Update the software to the latest version according to the information provided by the...

SUSE-SU-2024:0155-1 Security update for suse-module-tools

This update for suse-module-tools fixes the following issues: Updated to version 15.2.19: - Added a symlink for /boot/.vmlinuz.hmac bsc1217775. Updated to version 15.2.18: - CVE-2023-23559: Blacklisted RNDIS modules bsc1205767, jscPED-5731. - CVE-2023-1829: Blacklisted the clstcindex module...

Multiple Dahua Technology products vulnerable to authentication bypass

Overview Multiple products provided by Dahua Technology contain an authentication bypass vulnerability CWE-287. Mitsui Bussan Secure Directions, Inc. reported the vulnerability existed in "DHI-ASI7213Y-V3-T1" to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warnin...

Vulnerabilities fixed in Trend Micro Deep Security

Trend Micro has fixed vulnerabilities in Deep Security. A local malicious person can exploit the vulnerabilities to grant themselves elevated privileges and thus potentially execute arbitrary code execute arbitrary code with elevated privileges. Depending on the implementation this may include th...

JVN#83655695: Multiple Dahua Technology products vulnerable to authentication bypass

Multiple products provided by Dahua Technology contain an authentication bypass vulnerability CWE-287. Impact The product's identity verification may be bypassed if a remote attacker sends specially crafted data packets. Solution Update the software Update the software to the latest version...

PT-2024-15405 · WordPress · Connect Contact Form 7

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Connector WordPress plugin version 1.2.2 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back...

PT-2024-11521 · WordPress · Contact Form & Lead Form Elementor Builder

Name of the Vulnerable Software and Affected Versions: Contact Form & Lead Form Elementor Builder WordPress plugin versions prior to 1.7.0 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin not escaping some of its form fields before...

PT-2024-1538

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.35 and prior MySQL Server versions 8.2.0 and prior Description The vulnerability exists in the MySQL Server product due to insufficient input validation in the User-Defined Function UDF component. This allows a...

PT-2024-15213 · Peepso · The Community By Peepso

Name of the Vulnerable Software and Affected Versions: The Community by PeepSo WordPress plugin versions prior to 6.3.1.2 Description: The issue is related to the lack of a CSRF check when creating a user post, which could allow attackers to make logged-in users perform such actions via a CSRF...

PT-2024-11511 · WordPress · Wp-Invoice

Name of the Vulnerable Software and Affected Versions: WP-Invoice WordPress plugin versions 4.3.1 and earlier Description: The issue is related to the lack of CSRF check when updating settings and insufficient sanitization and escaping in some settings, allowing an attacker to make a logged-in...

PT-2024-1266 · Unknown +12 · X.Org Server +12

Name of the Vulnerable Software and Affected Versions: X.Org Server versions prior to 21.1.11 Xwayland versions prior to 23.2.4 xorg-server versions prior to 1.20.8-alt12 xorg-server versions prior to 1.20.14-alt11 xorg-xwayland versions prior to 23.1.1-alt4 Description: A heap buffer overflow fl...

GHSA-JC7H-C423-MPJC Apache Shiro vulnerable to path traversal

Apache Shiro before 1.130 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure blockSemicolon is enabled this is the default...

Pleasanter vulnerable to cross-site scripting

Overview Pleasanter provided by Implem Inc. contains a cross-site scripting vulnerability CWE-79. Masamitsu Kushi of Operation Group, Communication Technology Department, Digital Innovation HQ at Mitsubishi Heavy Industries, Ltd. reported this vulnerability to Implem Inc. and coordinated. After t...

PT-2024-5115 · Trend Micro +1 · Trend Micro Security +2

Name of the Vulnerable Software and Affected Versions: Trend Micro Security versions 17.x Trend Micro Maximum Security affected versions not specified Description: The issue is related to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged...

Security Bulletin: A vulnerability in axios affects IBM Robotic Process Automation and may result in cross-site request forgery (CVE-2023-45857).

Summary axios is used by IBM Robotic Process Automation as part of control center CVE-2023-45857. Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: Axios is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By inserting the X-XSRF-TOKEN header...

FCC wants cars to make life harder for stalkers

Most new model cars are not just cars anymore. With multiple digital systems, vehicles are increasingly plugged into web applications and digital processes. Some of them are basically smartphones on wheels. Even if we assume these new features were all created with your convenience in mind, some ...

DSA-5599-1 phpseclib - security update

Bulletin has no description...

PT-2024-1237 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.8.13 GitHub Enterprise Server versions prior to 3.9.8 GitHub Enterprise Server versions prior to 3.10.5 GitHub Enterprise Server versions prior to 3.11.3 Description: The issue is related to...