SUSE-RU-2023:4332-1 Recommended update for slurm

This update for slurm fixes the following issues: - Updated to version 23.02.5 with the following changes: Bug Fixes: + Revert a change in 23.02 where SLURMNTASKS was no longer set in the job's environment when --ntasks-per-node was requested. The method that is is being set, however, is differen...

PT-2023-28713 · Unknown · Franfinance

Name of the Vulnerable Software and Affected Versions: franfinance versions prior to 2.0.27 Description: The issue allows a remote attacker to execute arbitrary code via the validation.php and controllers/front/validation.php components. Recommendations: For versions prior to 2.0.27, update to...

PT-2023-6643 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 119.0.6045.105 Description: The issue is related to an integer overflow in the USB interface of Google Chrome, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a craft...

PT-2023-32109

Name of the Vulnerable Software and Affected Versions EDM Informatics E-invoice versions prior to 2.1 Description The issue is related to improper protection for outbound error messages and alert signals, allowing account footprinting. This can potentially reveal sensitive information about user...

PT-2023-6428

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to 1.9.0 Description A security issue in ingress-nginx allows for arbitrary command execution due to annotation injection. This can be exploited by a remote attacker to execute arbitrary code or elevate privileges...

PT-2023-31977 · WordPress · Chatbot

Name of the Vulnerable Software and Affected Versions: ChatBot plugin for WordPress versions up to, and including, 4.8.9 Description: The issue allows unauthenticated attackers to extract sensitive data, including confirmation of whether a user name exists on the site and order information for...

PT-2023-28164 · Schedmd +2 · Slurm +2

Name of the Vulnerable Software and Affected Versions: SchedMD Slurm versions 23.02.x through 23.02.5 SchedMD Slurm versions 22.05.x through 22.05.9 Description: The issue allows filesystem race conditions, which can be exploited to gain ownership of a file, overwrite a file, or delete files...

io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. Impact This is a DDOS attack, any http2 server is affected and so you should update as soon as possible. Patches This is patched in version...

PT-2023-22937 · Samsung · Samsung Health

Name of the Vulnerable Software and Affected Versions: Samsung Health versions prior to 6.24.3.007 Description: The issue is related to improper access control, allowing attackers to access sensitive information via implicit intent. Recommendations: For versions prior to 6.24.3.007, update to...

PT-2023-31863 · WordPress · Modal Window

Name of the Vulnerable Software and Affected Versions: The Modal Window plugin for WordPress versions up to, and including, 5.3.5 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes...

PT-2023-19191 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.6.17 GitHub Enterprise Server versions prior to 3.7.15 GitHub Enterprise Server versions prior to 3.8.8 GitHub Enterprise Server versions prior to 3.9.3 GitHub Enterprise Server versions prior to...

Medium: gdk-pixbuf2

Issue Overview: GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12. CVE-2021-44648 Affected Packages: gdk-pixbuf2 Issue Correction: Run dnf update gdk-pixbuf2...

PT-2023-5189 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: The issue is related to the QMS.Mobile module of the QMS Automotive software, which does not properly invalidate session tokens upon logout. This could allow an attacker to perform session...

PT-2023-26807 · Conemu · Conemu

Name of the Vulnerable Software and Affected Versions: ConEmu versions prior to commit 230724 Description: The issue is related to the incorrect sanitization of title responses for control characters, potentially leading to arbitrary code execution. This is connected to an incomplete fix for a...

PT-2023-4798 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 116.0.5845.179 Description: The issue is related to a use after free in the Networks component, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. The severity o...

Multiple vulnerabilities in SHIRASAGI

Overview SHIRASAGI provided by SHIRASAGI Project contains multiple vulnerabilities listed below. Reflected cross-site scripting CWE-79 - CVE-2023-36492 Stored cross-site scripting CWE-79 - CVE-2023-38569 Path traversal CWE-22 - CVE-2023-39448 CVE-2023-36492, CVE-2023-38569 Taiga Shirakura of Mits...

PT-2023-5103 · Vim +10 · Vim +10

Name of the Vulnerable Software and Affected Versions: vim versions prior to 9.0.1858 Description: The issue is related to a use-after-free vulnerability in the vim text editor, specifically in the ins compl get exp function. This vulnerability is associated with the use of memory after it has be...

PT-2023-4937 · Mutt +9 · Mutt +9

Name of the Vulnerable Software and Affected Versions: Mutt versions 1.5.2 through 2.2.12 Description: The issue is related to a null pointer dereference when composing from a specially crafted draft message. This can potentially allow an attacker to cause a denial of service. The vulnerability i...

PT-2023-26259 · Ivanti · Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche Manager versions prior to 6.4.1 Description: A security vulnerability within Ivanti Avalanche Manager may allow an unauthenticated attacker to create a buffer overflow, potentially leading to service disruption or arbitrary...

"Skylark" App fails to restrict custom URL schemes properly

Overview "Skylark" App provided by SKYLARK HOLDINGS CO., LTD. provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-939, CVE-2023-40530, CVE-2024-54014 which may be exploited to direct the App to access any sites...