PT-2023-5991 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-beta1 and earlier Adobe Commerce versions 2.4.6-p2 and earlier Adobe Commerce versions 2.4.5-p4 and earlier Adobe Commerce versions 2.4.4-p5 and earlier Description: The issue is related to an Improper...

PT-2023-22929 · Unknown · Secsettings

Name of the Vulnerable Software and Affected Versions: SecSettings versions prior to SMR Oct-2023 Release 1 Description: The issue is related to an improper access control vulnerability. This vulnerability allows attackers to enable Wi-Fi and connect to arbitrary Wi-Fi networks without any user...

PT-2023-7964 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Foxit PDF Editor affected versions not specified Description: The issue is related to a use-after-free vulnerability in the handling of Doc objects within Foxit PDF Reader and Foxit PDF Editor...

Improper restriction of XML external entity references (XXE) in FD Application

Overview FD Application provided by Ministry of Health, Labour and Welfare improperly restricts XML external entity references XXE CWE-611. Toyama Taku and Sakaki Ryutaro of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Ear...

PT-2023-28097 · Gold Plugins · Gold Plugins Locations

Name of the Vulnerable Software and Affected Versions: Gold Plugins Locations plugin versions prior to 4.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This allows for malicious scripts to be stored...

PT-2023-28122 · WordPress · Click To Tweet

Name of the Vulnerable Software and Affected Versions: Click To Tweet plugin versions = 2.0.14 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

JVN#39596244: Improper restriction of XML external entity references (XXE) in FD Application

FD Application provided by Ministry of Health, Labour and Welfare improperly restricts XML external entity references XXE CWE-611. Impact By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker. Solution Update the Software Update the software to the...

PT-2023-28068 · WordPress · Sendpress Newsletters

Name of the Vulnerable Software and Affected Versions: SendPress Newsletters plugin versions prior to 1.22.3.31 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This type of vulnerability allows an attacker to inje...

PT-2023-29129 · WordPress · Jesweb.Dev Anchor Episodes Index

Name of the Vulnerable Software and Affected Versions: jesweb.Dev Anchor Episodes Index Spotify for Podcasters plugin versions = 2.1.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For...

DLA-3598-1 libvpx - security update

Bulletin has no description...

MGASA-2023-0276 Updated xrdp packages fix security vulnerability

In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The authstartsession function can return non-zero 1 value on, e.g., PAM error which may result in session restrictions such as max concurrent sessions per user by PAM ex...

MGASA-2023-0278 Updated giflib packages fix security vulnerability

The updated packages fix a security vulnerability: giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c. CVE-2023-39742...

CVE-2023-39410 Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro...

DLA-3586-1 ncurses - security update

Bulletin has no description...

Cisco Catalyst SD-WAN Manager Web UI HTML Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could...

Cisco IOS XE Software for ASR 1000 Series Aggregation Services Routers IPv6 Multicast Denial of Service Vulnerability

A vulnerability in the Multicast Leaf Recycle Elimination mLRE feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause the affected device to reload, resulting in a denial of service DoS condition. This...

Cisco IOS XE Software Layer 2 Tunneling Protocol Denial of Service Vulnerability

A vulnerability in the Layer 2 Tunneling Protocol L2TP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain L2TP packets. An attacker could explo...

Cisco Wireless LAN Controller AireOS Software Denial of Service Vulnerability

A vulnerability in the memory buffer of Cisco Wireless LAN Controller WLC AireOS Software could allow an unauthenticated, adjacent attacker to cause memory leaks that could eventually lead to a device reboot. This vulnerability is due to memory leaks caused by multiple clients connecting under...

Cisco IOS XE Software for Wireless LAN Controllers Wireless Network Control Denial of Service Vulnerability

A vulnerability in the Wireless Network Control daemon wncd of Cisco IOS XE Software for Wireless LAN Controllers could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. This vulnerability is due to improper memory management. An attacker could exploit this...

Cisco Access Point Software Uncontrolled Resource Consumption Vulnerability

A vulnerability in the packet processing functionality of Cisco access point AP software could allow an unauthenticated, adjacent attacker to exhaust resources on an affected device. This vulnerability is due to insufficient management of resources when handling certain types of traffic. An...