KLA61569 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, cause denial of service, spoof user interface. Below is a complete list of vulnerabilities: 1. Information disclosure vulnerabilit...

PT-2023-29716 · WordPress · Happybox Newsletter & Bulk Email Sender – Email Newsletter Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: HappyBox Newsletter & Bulk Email Sender – Email Newsletter Plugin for WordPress plugin versions = 2.0.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows authenticated users with...

PT-2023-27094 · Unknown · Matsuya Line

Name of the Vulnerable Software and Affected Versions: Matsuya Line version 13.6.1 Description: The leakage of the client secret allows attackers to obtain the channel access token and send crafted broadcast messages. Recommendations: For Matsuya Line version 13.6.1, update to a version that fixe...

PT-2023-29621 · WordPress · Cpt Shortcode Generator

Name of the Vulnerable Software and Affected Versions: CPT Shortcode Generator plugin versions prior to 1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 1.1...

PT-2023-6753 · Unknown +11 · Buc Traceroute +11

Name of the Vulnerable Software and Affected Versions: buc Traceroute versions 2.0.12 through 2.1.2 Description: The issue is related to the improper parsing of command lines by the wrapper scripts in buc Traceroute. This could allow a remote attacker to execute arbitrary code. Recommendations: F...

Squid Request/Response Smuggling Vulnerability (GHSA-j83v-w3p4-5cqh, SQUID-2023:1)

Squid is prone to a request/response smuggling vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:squid-cache:squid";...

Important: kernel-livepatch-6.1.29-50.88

Issue Overview: A use-after-free vulnerability in the Linux kernel's net/sched: clsu32 component can be exploited to achieve local privilege escalation. If tcfchangeindev fails, u32setparms will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter...

PT-2023-29838 · Userback · Userback

Name of the Vulnerable Software and Affected Versions: Userback plugin versions 1.0.13 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

Advisory ROSA-SA-2023-2255

software: mariadb 10.5.20 OS: ROSA-CHROME packageevrstring: mariadb-10.5.20-1.src.rpm CVE-ID: CVE-2022-32088 BDU-ID: 2022-04064 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Exectimetracker::getloops/Filesorttracker::reportuse/filesort function of the MariaDB database management system is...

Mageia: Security Advisory (MGASA-2023-0291)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-31580 · WordPress · Leaflet Map

Name of the Vulnerable Software and Affected Versions: Leaflet Map plugin for WordPress versions up to, and including, 3.3.0 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping. This allows authenticated...

Ubuntu: Security Advisory (USN-6394-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle MySQL Server 8.x <= 8.0.34 Security Update (cpuoct2023) - Linux

Oracle MySQL Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:mysql"; if...

PT-2023-29391 · WordPress · Kardi Order Auto Complete For Woocommerce

Name of the Vulnerable Software and Affected Versions: Kardi Order auto complete for WooCommerce plugin versions = 1.2.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the Kardi...

RHEL 9 : java-17-openjdk (RHSA-2023:5753)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5753 advisory. The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixe...

PT-2023-29585 · Unknown · Scott Reilly Get Custom Field Values

Name of the Vulnerable Software and Affected Versions: Scott Reilly Get Custom Field Values plugin versions = 4.0.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject malicious scripts...

AZL-59705 CVE-2023-45803 affecting package python3 for versions less than 3.9.19-14

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...

Advisory ROSA-SA-2023-2247

software: openexr 2.5.8 OS: ROSA-CHROME packageevrstring: openexr-2.5.8-1.src.rpm CVE-ID: CVE-2021-23169 BDU-ID: 2021-04603 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the copyIntoFrameBuffer function of the OpenEXR wide dynamic range luminance image storage software is related to writing beyo...

PT-2023-28380 · Unknown · Onsinview2

Name of the Vulnerable Software and Affected Versions: OnSinView2 versions 2.0.1 and earlier Description: An issue with improper restriction of operations within the bounds of a memory buffer exists. If exploited, this could lead to information disclosure or the execution of arbitrary code by...

Amazon Corretto Java 8.x < 8.392.08.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 8 8.392.08.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2023-Oct-17 advisory. - other-libs/corba CVE-2023-22067 - security-libs/javax.net.ssl CVE-2023-22081 Note that Nessus has no...