PT-2023-19680 · Canonical +9 · Golang-Github-Golang-Protobuf-1-3 +7

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue arises when parsing invalid messages, which can cause a panic. Specifically, parsing a text-format message that contains a potential number...

Fastly Secret Disclosure Vulnerability

Fastly suffers from the poor practice of sending a temporary password in plaintext. Correspondence from Fastly declined to comment regarding new discovered vulnerabilities within their website. Poor practices regarding password changes. 1. Reset user password 2. Access link sent 3. Temporary...

SUSE-SU-2023:0707-1 Security update for python39

This update for python39 fixes the following issues: - CVE-2023-24329: Fixed blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters bsc1208471. Update to 3.9.16: - python -m http.server no longer allows terminal control characters sent within a...

CVE-2023-27985

A flaw was found in the Emacs text editor. When opened with emacsclient-mail.desktop, a crafted mailto URI can result in shell command injection due to lack of compliance with the Desktop Entry Specification...

postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions

A flaw was found in org.postgresql. This issue allows the creation of a temporary file when using PreparedStatement.setTextint, InputStream and PreparedStatemet.setByteaint, InputStream. This could allow a user to create an unexpected file available to all users, which could end in unexpected...

apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

Exploit for Integer Overflow or Wraparound in Microsoft

CVE-2023-21716 Microsoft Word RTF Font Table Heap Corruption...

Debian: Security Advisory (DLA-1219-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-297-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

An exposure of sensitive information to an unauthorized actor CWE-200 vulnerability in FortiAnalyzer versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4 and 6.4.0 through 6.4.10 may allow a remote authenticated attacker to read the client machine password in plain text in a heartbeat response when ...

Security Bulletin: IBM Security Guardium is affected by the following vulnerabilities [CVE-2022-39166, CVE-2022-34917, CVE-2022-42889]

Summary IBM Security Guardium has addressed these vulnerabilities CVE-2022-39166, CVE-2022-34917, CVE-2022-42889 Vulnerability Details CVEID:CVE-2022-39166 DESCRIPTION: IBM Security Guardium could allow a privileged user to obtain sensitive information inside of an HTTP response. CVSS Base score:...

CVE-2023-23776

An exposure of sensitive information to an unauthorized actor CWE-200 vulnerability in FortiAnalyzer versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4 and 6.4.0 through 6.4.10 may allow a remote authenticated attacker to read the client machine password in plain text in a heartbeat response when ...

DataSurgeon - Quickly Extracts IP's, Email Addresses, Hashes, Files, Credit Cards, Social Secuirty Numbers And More From Text

DataSurgeon ds is a versatile tool designed for incident response, penetration testing, and CTF challenges. It allows for the extraction of various types of sensitive information including emails, phone numbers, hashes, credit cards, URLs, IP addresses, MAC addresses, SRV DNS records and a lot...

PT-2023-13821 · Qualcomm · Snapdragon +143

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption in the Bluetooth HOST when processing the AVRC PDU GET PLAYER APP VALUE TEXT AVRCP response. This suggests a proble...

CVE-2023-22481

CVE-2023-22481 affects FreshRSS with its greader API. The failure paths unauthorized()/badRequest() print debugInfo(), which returns the request content, causing passwords or API keys to be logged in clear in users/_/log_api.txt (and optionally syslog if COPY_LOG_TO_SYSLOG is true). Exploitation ...

PT-2023-15915 · Icplayer · Icplayer

Name of the Vulnerable Software and Affected Versions: icplayer versions up to 0.819 Description: A vulnerability was found in icplayer, affecting the function AddonText Selection create of the file addons/Text Selection/src/presenter.js. This issue leads to cross-site scripting and can be launch...

icplayer 跨站脚本漏洞

icplayer is icplayer open source HTML5 player for an interactive course. A cross-site scripting vulnerability exists in versions prior to icplayer 0.820, which originated from a vulnerability found in the file addons/TextSelection/src/presenter.js has a problem with the function...

Yapscan Denial of Service vulnerability in report server

Impact If you use the report server, it may be vulnerable to a Denial of Service attack. Patches Has been patched in v0.19.2. References The vulnerability was inherited by the following upstream vulnerabilites - golang.org/x/text v0.3.7 - golang.org/x/net 0.0.0-20220906165146-f3363e06e74c...

GHSA-WXWQ-525W-HCQX Yapscan Denial of Service vulnerability in report server

Impact If you use the report server, it may be vulnerable to a Denial of Service attack. Patches Has been patched in v0.19.2. References The vulnerability was inherited by the following upstream vulnerabilites - golang.org/x/text v0.3.7 - golang.org/x/net 0.0.0-20220906165146-f3363e06e74c...

XWiki Platform may allow privilege escalation to programming rights via user's first name

Impact Any user can edit his own profile and inject code which is going to be executed with programming right. Steps to reproduce: Set your first name to cache id="userProfile"groovyprintln"Hello from groovy!"/groovy/cache The first name appears as interpreted "Hello from groovy" instead of the...