Important: glibc

Issue Overview: A flaw was found in glibc. When the getaddrinfo function is called with the AFUNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function...

PT-2023-22938 · Unknown · S Assistant

Name of the Vulnerable Software and Affected Versions: SAssistant versions prior to 8.7 Description: The issue allows local attackers to access backup data in SAssistant due to an improper preservation of permissions. This enables unauthorized access to sensitive information. Recommendations: For...

PT-2023-26237 · Presspage Entertainment Inc. · Smarty

Name of the Vulnerable Software and Affected Versions: PressPage Entertainment Inc. Smarty for WordPress plugin versions 3.1.35 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into...

Medium: libxml2

Issue Overview: Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service DoS via supplying a crafted XML file. CVE-2023-39615 Affected Packages: libxml2 Issu...

Medium: golang

Issue Overview: The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to...

Medium: cups

Issue Overview: A vulnerability was found in OpenPrinting CUPS. The security flaw occurs due to failure in validating the length provided by an attacker-crafted CUPS document, possibly leading to a heap-based buffer overflow and code execution. CVE-2023-4504 Affected Packages: cups Issue...

PT-2023-9125 · Qnap · Qnap Qts +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.4.2596 build 20231128 QNAP QuTS hero versions prior to 5.1.4.2596 build 20231128 Description: A buffer copy without checking the size of input issue has been reported, potentially allowing authenticated...

PT-2023-28074 · Unknown · Nigauri Insert Estimated Reading Time

Name of the Vulnerable Software and Affected Versions: nigauri Insert Estimated Reading Time plugin versions 1.2 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For nigauri Inser...

VMware Carbon Black App Control SEoL (8.9.x)

According to its version, VMware Carbon Black App Control is 8.9.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities...

NodeBB < 2.6.1 Account Takeover Vulnerability

NodeBB is prone to an account takeover vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodebb:nodebb"; ifdescripti...

PT-2023-5670 · Acronis · Acronis Cyber Protect 15 +1

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 15 versions before build 35979 Description: The issue is related to a sensitive information leak through log files. This could allow an attacker to gain unauthorized access to protected information. Recommendations: For...

WordPress Customizer Export/Import Plugin < 0.9.6 PHP Object Injection Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpbeaverbuilder:customizerexport%2fimport"; if description...

PT-2023-5639 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 117.0.5938.132 Description: The issue is related to a use after free in the Extensions component of Google Chrome, which could allow an attacker to exploit heap corruption via a crafted HTML page if a user is...

PT-2023-27770 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14 Description: A logic issue was addressed with improved checks, allowing an app to bypass Gatekeeper checks. The issue is fixed in macOS Sonoma 14. Recommendations: For versions prior to 14, update to macOS Sonoma 14...

PT-2023-8483 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14 Description: The issue is related to a lack of protection for service data in the printing component of the macOS operating system. This could allow an attacker to disclose protected information. An app may be able ...

KLA60813 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Out of bounds write vulnerability in PathOps can be exploited to cause denial of servic...

PT-2023-28596 · WordPress · Wp Activity Log

Name of the Vulnerable Software and Affected Versions: Activity Log WordPress plugin versions prior to 2.8.8 Description: The issue allows an attacker to manipulate the client IP address by exploiting the plugin's retrieval of IP addresses from potentially untrusted headers. This can be used to...

Medium: ansible

Issue Overview: A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the nolog...

PT-2023-28709 · Unknown · Szvone Vmqphp

Name of the Vulnerable Software and Affected Versions: szvone vmqphp versions =1.13 Description: The issue allows unauthorized remote users to use SQL injection attacks to obtain the hash of the administrator password. This can be achieved through sql injection attacks, which enable attackers to...

Important: tomcat

Issue Overview: A deserialization flaw was discovered in Apache Tomcat's use of a FileStore. Under specific circumstances, an attacker can use a specially crafted request to trigger Remote Code Execution through deserialization of the file under their control. The highest threat from the...