Mozilla Thunderbird < 102.14

The version of Thunderbird installed on the remote Windows host is prior to 102.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-32 advisory. - Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and...

CVE-2023-4050

In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...

SUSE-SU-2023:3097-1 Security update for pipewire

This update for pipewire fixes the following security issues: - Fixed issue where an app which only has permission to access one stream can also access other streams bsc1213682. Bugfixes: - Fixed division by 0 and other issues with invalid values glfopipewire/pipewire2953 - Fixed an overflow...

PT-2023-36239 · Pipewire · Pipewire

Name of the Vulnerable Software and Affected Versions: pipewire affected versions not specified Description: The issue allows an app with permission to access one stream to also access other streams. This is a security concern as it bypasses intended access controls. Additionally, there were fixe...

Stanford CoreNlp code injection vulnerability

Stanford CoreNlp is a suite of open source, natural language parsing tools written in Java by the Stanford Nlp Group team. A security vulnerability exists in Stanford CoreNlp stanford-parser v3.9.2 and earlier versions, which stems from a code injection vulnerability in the component...

org.apache.bookkeeper.tests:stream-storage-integration-test (4.7.0), org.apache.bookkeeper:stream-storage-server (4.7.0) +1 more potentially affected by CVE-2023-38647 via org.apache.helix:helix-core (0.6.7)

org.apache.helix:helix-core MAVEN version 0.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.helix:helix-core and may be impacted: - org.apache.bookkeeper.tests:stream-storage-integration-test 4.7.0 -...

EulerOS Virtualization 3.0.6.6 : systemd (EulerOS-SA-2023-2403)

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A use-after-free vulnerability was found in systemd. This issue occurs due to the onstreamio function and dnsstreamcomplete...

PT-2023-25975 · Unknown +1 · Plexis Archiver +1

Name of the Vulnerable Software and Affected Versions: Plexis Archiver versions prior to 4.8.0 Description: The issue arises when using AbstractUnArchiver for extracting an archive, potentially leading to arbitrary file creation and possibly remote code execution. This occurs when an archive entr...

Why are there so many malware-as-a-service offerings?

Whether known as commodity malware or "as-a-service," threat actors have long been turning to their fellow adversaries in the hopes of selling off their tools and opening a new stream of revenue. When used legitimately, as-a-service software is when a third-party company offers its software to...

WordPress Video Analytics for Cloudflare Stream Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Video Analytics for Cloudflare Stream Type Plugin Vulnerable versions = 1.1 Fixed in 1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID ca3447e66eaa Credits Rafie Muhammad...

WordPress WP Lead Stream Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Lead Stream Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d2971cba9459 Credits Rafie Muhammad Patchstack Required...

AZL-27682 CVE-2023-35945 affecting package nghttp2 for versions less than 1.46.0-3

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWA...

ALPINE-CVE-2023-35945

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWA...

AZL-27667 CVE-2023-35945 affecting package cmake for versions less than 3.21.4-8

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWA...

AZL-27683 CVE-2023-35945 affecting package nodejs18 for versions less than 18.17.1-2

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWA...

PT-2023-25396

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.23.11 Envoy versions prior to 1.24.9 Envoy versions prior to 1.25.8 Envoy versions prior to 1.26.3 Description Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RST STREAM immediatel...

Envoy resource management error vulnerability

Envoy is an open source distributed proxy server. A resource management error vulnerability exists in Envoy versions prior to 1.27.0, which stems from the possibility that Envoy's HTTP/2 codec may leak header maps and bookkeeping structures after receiving the frame RSTSTREAM from an upstream...

OESA-2023-1411 guava20 security update

Guava is a set of core libraries that includes new collection types ,immutable collections, a graph library, and utilities for concurrency, I/O, hashing, primitives, strings, and more. Security Fixes: Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2023-2292)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a...

EulerOS 2.0 SP11 : kernel (EulerOS-SA-2023-2272)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode swit...