Siemens in SCALANCE Products (CVE-2022-46140)

Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file and retrieve debug information about the system. This plugin only works with Tenable.ot. Please visit...

Siemens in SCALANCE Products (CVE-2022-46142)

Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the CLI user passwords. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

EasyMail vulnerable to cross-site scripting

Overview EasyMail provided by First Net Japan Inc. contains a stored cross-site scripting vulnerability CWE-79. Toyama Taku reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may be executed...

PT-2023-19586 · Jenkins · Jenkins Azure Ad Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Azure AD Plugin versions 303.va 91ef20ee49f and earlier Description: The issue is related to the Jenkins Azure AD Plugin not invalidating the previous session on login. This could potentially allow unauthorized access. Recommendations...

PT-2023-19613 · Jenkins · Jenkins Testquality Updater Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins TestQuality Updater Plugin versions 1.3 and earlier Description: A missing check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password...

PT-2023-19597 · Jenkins · Jenkins Jira Pipeline Steps Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JIRA Pipeline Steps Plugin versions 2.0.165.v8846cf59f3db and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially...

OPENSUSE-SU-2023:0030-1 Security update for python-mechanize

This update for python-mechanize fixes the following issues: Update to version 0.4.8: - CVE-2021-32837: Fixed a denial of service via regular expression boo1207242. - Fixed mechanize not found during build boo1202003...

RLSA-2023:0335 Moderate: dbus security update

D-Bus is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility. Security Fixes: dbus: dbus-daemon crashes when receiving message with incorrectly nested parentheses and curly brackets...

PT-2023-14890 · WordPress · Shiftnav

Name of the Vulnerable Software and Affected Versions: ShiftNav WordPress plugin versions prior to 1.7.2 Description: The issue allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins, due to th...

JVN#72418815: Pgpool-II vulnerable to information disclosure

Pgpool-II is cluster management tool. Pgpool-II contains an information disclosure vulnerability CWE-200 in its watchdog function. Note that, only systems that meet all of the following setting requirements are affected by this vulnerability. Watchdog function is enabled usewatchdog = on "query...

PT-2023-33038 · Unknown · Securitycomponent

Name of the Vulnerable Software and Affected Versions: Software versions prior to 2.4.8 and 1.3.18 Description: The issue allows forms secured by SecurityComponent to be submitted to any action without triggering the tampering protection. This could lead to mass assignment issues in applications...

PT-2023-1149 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10611 Zoho ManageEngine ServiceDesk Plus versions 13.x prior to 13004 Description: The issue is related to the implementation of the authentication mechanism via the LDAP protocol in th...

PT-2023-14504

Name of the Vulnerable Software and Affected Versions ActiveRecord versions prior to 6.1.7.1 ActiveRecord versions prior to 7.0.4.1 Description A denial of service issue is present in ActiveRecord's PostgreSQL adapter. When a value outside the range for a 64bit signed integer is provided to the...

SUSE-SU-2023:0094-1 Security update for python36-setuptools

This update for python36-setuptools fixes the following issues: - CVE-2022-40897: Fixed an excessive CPU usage that could be triggered by fetching a malicious HTML document bsc1206667...

PT-2023-34077 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to 5.15.86 Description: The issue introduces active flags to prevent Use After Free UAF when an applicant uninitializes. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linu...

PT-2023-33198 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.83 Description: A memory leak issue was discovered in the dpaa2-switch component, specifically in the dpaa2 switch acl entry add and dpaa2 switch acl entry remove functions. The actual impact and attack...

PT-2023-34148 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.86 Description: A refcount leak was discovered in the f hid gadget of the Linux Kernel. The issue was introduced in version v3.19 and is fixed in version v5.15.86. The actual impact and attack plausibility...

PT-2023-14216 · Adeel Ahmed · Ip Blacklist Cloud

Name of the Vulnerable Software and Affected Versions: Adeel Ahmed's IP Blacklist Cloud plugin versions prior to 5.01 Description: The issue is related to an authentication SQL Injection vulnerability. Recommendations: For versions prior to 5.01, update to version 5.01 or later to resolve the iss...

PT-2023-14417 · Unknown · Fc46-Webbridge

Name of the Vulnerable Software and Affected Versions: FC46-WebBridge versions prior to 3.7.6.25p0 3.2.2.17p0 4.7p0 Description: An issue in the web server of FC46-WebBridge allows arbitrary files and configurations to be read via directory traversal over TCP port 8888. Recommendations: For...

PT-2023-18407

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to v6.14 Description The issue allows a remote unauthenticated attacker to redirect a user to an arbitrary web site, potentially conducting a phishing attack by having the user access a specially crafted URL...