PT-2023-27765

Name of the Vulnerable Software and Affected Versions hyper-bump-it versions prior to 0.5.1 Description The issue arises from hyper-bump-it reading a file glob pattern from the configuration file and combining it with the project root directory to construct a full glob pattern. This pattern is us...

PT-2023-27764 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper affected versions not specified Description: The order of evaluation of the arguments of the builtin functions uint256 addmod, uint256 mulmod, ecadd, and ecmul does not follow source order. This behavior is problematic when the evaluati...

Security Bulletin: Google Guava component is vulnerable to CVE-2023-2976 is used by IBM Maximo Application Suite

Summary IBM Maximo Application Suite uses Google Guava package which is vulnerable to CVE-2023-2976. Vulnerability Details CVEID:CVE-2023-2976 DESCRIPTION: Google Guava could allow a local authenticated attacker to obtain sensitive information, caused by a flaw with using Java's default temporary...

SUSE CVE-2023-38037

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current umask settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that ha...

PT-2023-27724 · Senayan Library Management System · Slims

Name of the Vulnerable Software and Affected Versions: Senayan Library Management Systems SLIMS 9 Bulian version 9.6.1 Description: The issue is related to Server Side Request Forgery SSRF and can be exploited via the "admin/modules/bibliography/pop p2p.php" endpoint. This allows for potentially...

PT-2023-26134 · General Solutions Steiner Gmbh · Case 3 Taskmanagement

Name of the Vulnerable Software and Affected Versions: General Solutions Steiner GmbH CASE 3 Taskmanagement version 3.3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter. This enables the...

PT-2023-25536 · Relic · Relic

Name of the Vulnerable Software and Affected Versions: RELIC versions before commit 34580d840469361ba9b5f001361cad659687b9ab Description: The issue allows attackers to execute arbitrary code, cause a denial of service, and escalate privileges when calling the realloc function in the bn grow...

CVE-2023-38037

An insecure temporary file vulnerability was found in activesupport rubygem. Contents that will be encrypted are written to a temporary file that has the user’s current umask settings, possibly leading to information disclosure by other users on the same system. Mitigation To work around this...

PT-2023-28018 · Grupposcai · Realgimm

Name of the Vulnerable Software and Affected Versions: GruppoSCAI RealGimm version 1.1.37p38 Description: An improper error handling issue in the ErroreNonGestito.aspx component allows attackers to obtain sensitive technical information via a crafted SQL query. Recommendations: For GruppoSCAI...

PT-2023-28082 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.3.1-9346-6 Description: The issue allows remote attackers to obtain sensitive information via unspecified vectors. This is related to the exposure of sensitive information to an unauthorized act...

PT-2023-27671 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 1.0 Description: The issue concerns a buffer overflow that occurs via the function sub 34FD0. This function reads user-provided parameters and passes variables without performing any length checks, leading to the overflow...

PT-2023-27673 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version US AC6V1.0BR V15.03.05.16 multi TD01.bin Description: The issue is related to a Buffer Overflow that occurs via the function "initIpAddrInfo". This function reads in a user-provided parameter and passes the variable without...

PT-2023-27667 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 Description: The issue concerns a Buffer Overflow that can be triggered via the add white node function. Recommendations: For version 15.03.05.16, consider disabling the add white node function as a temporary...

Vulnerable postgresql component found in SANnav RPM package

pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either PreparedStatement.setTextint, InputStream or PreparedStatemet.setByteaint, InputStream will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which...

PT-2023-8337 · Unknown · Smartnode Sn200

Name of the Vulnerable Software and Affected Versions: SmartNode SN200 aka SN200 version 3.21.2-23021 Description: The issue is related to the Network Diagnostic Commands function of the SmartNode SN200 analog telephone adapter's firmware, which fails to neutralize special elements used in an...

Locally Encrypted File Disclosure

ActiveSupport is vulnerable to Locally Encrypted File Disclosure. The vulnerability exists because the library's temporary file's permissions default to the user's current umask settings, which allows an attacker on the same system to read the contents of the temporary file before it gets encrypt...

PT-2023-27640 · Phicomm · Phicomm K2

Name of the Vulnerable Software and Affected Versions: Phicomm k2 version 22.6.529.216 Description: The Phicomm k2 router contains a command injection vulnerability via the luci.sys.call function. This issue allows for remote command execution. Recommendations: For Phicomm k2 version 22.6.529.216...

PT-2023-27643 · Tenda · Tenda Ac23

Name of the Vulnerable Software and Affected Versions: Tenda AC23 version Vv16.03.07.45 cn Description: The issue is related to a Buffer Overflow vulnerability via the sub 450A4C function. Recommendations: For Tenda AC23 version Vv16.03.07.45 cn, as a temporary workaround, consider disabling the...

PT-2023-27645 · Tenda · Tenda Ac23

Name of the Vulnerable Software and Affected Versions: Tenda AC23 version 16.03.07.45 cn Description: The issue arises from the sub 451784 function not validating user-entered parameters, leading to a stack overflow. Recommendations: For Tenda AC23 version 16.03.07.45 cn, as a temporary workaroun...

PT-2023-26334 · Keylime +3 · Keylime +3

Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 7.5.0 Description: A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide t...