UBUNTU-CVE-2023-6817

A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The function nftpipapowalk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO Pile Packet Policies elements, leadi...

PT-2023-31067 · Unknown · Kulwant Nagi Affiliate Booster

Name of the Vulnerable Software and Affected Versions: Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates versions 3.0.5 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf ...

PT-2023-8085

Name of the Vulnerable Software and Affected Versions Flask-Security-Too versions =2.1.0 may impact applications that were previously not affected, as the autocorrect location header configuration was changed to False, making location headers in redirects relative by default. Recommendations For...

PT-2023-31711 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.182 Description: The issue is related to the mishandling of ACLs for audit logs in the app/Controller/AuditLogsController.php file. Recommendations: For versions prior to 2.4.182, update to version 2.4.182 or later ...

PT-2023-14653 · Unknown · Aleksandar Urošević Stock Ticker

Name of the Vulnerable Software and Affected Versions: Aleksandar Urošević Stock Ticker versions 3.23.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected cross-site scripting XSS. This means an attacker can...

PT-2023-31615 · Cube · Cube

Name of the Vulnerable Software and Affected Versions: Cube versions prior to 0.34.34 Description: The issue allows an attacker to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The problem has been patched in version 0.34.34. It is...

Incorrect Authorization

Overview UmbracoCms.Web is an ASP.NET CMS. Affected versions of this package are vulnerable to Incorrect Authorization due to improper access control mechanisms. An attacker can gain access to unauthorized functionalities or data by exploiting the endpoints that are not adequately secured...

Incorrect Authorization

Overview UmbracoCms.Web is an ASP.NET CMS. Affected versions of this package are vulnerable to Incorrect Authorization due to improper authorization mechanism. An attacker with only send for approval permissions could exploit this weakness to publish content without the required publish...

Enterprise Search 8.11.2 / 7.17.16 Security Update (ESA-2023-31)

Enterprise Search Insertion of Sensitive Information into Log File ESA-2023-31 An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion o...

CVE-2023-49782 Cross-Site-Scripting vulnerability in error message passing in richdocumentscode

Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php. The bug was fixed in Collabora Online - Built-in CODE Server richdocumentscode release 23.5.601...

CVE-2023-49788 Improper handling of browser-side provided input in richdocuments path handling

Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CODE Server richdocumentscode is run without chroot sandboxing. Vulnerable versions of the richdocumentscode app can be susceptible to attac...

SUSE CVE-2023-49080

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information...

SUSE CVE-2023-49285

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds fo...

SUSE CVE-2023-49286

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There a...

CVE-2023-48693 Azure RTOS ThreadX Remote Code Execution Vulnerability

Azure RTOS ThreadX is an advanced real-time operating system RTOS designed specifically for deeply embedded applications. An attacker can cause arbitrary read and write due to vulnerability in parameter checking mechanism in Azure RTOS ThreadX, which may lead to privilege escalation. The affected...

Security Patch Release - Ivanti Policy Secure 22.6R1

Resolutions for Ivanti Policy Secure Security Issues: As part of Ivanti's commitment to continuous security hardening, Ivanti has released a security update for Ivanti Policy Secure. This update resolves a moderate vulnerability. To our knowledge, none of the CVEs identified in this review have...

PT-2023-28438 · Samsung · Ar Emoji

Name of the Vulnerable Software and Affected Versions: AR Emoji versions prior to SMR Dec-2023 Release 1 Description: The issue is related to improper authorization verification, allowing attackers to read sandbox data of AR Emoji. Recommendations: For versions prior to SMR Dec-2023 Release 1,...

Low: vim

Issue Overview: Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit 25aabc2b which has been included in...

CVE-2023-48314 Unescaped passing of the request URL in Collabora Online

Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with Collabora Online Built-in CODE Server app can be vulnerable to attack via proxy.php. This vulnerability has been fixed in Collabora Online - Built-in CODE Server richdocumentscode...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Python

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Python. Vulnerability Details CVEID:CVE-2023-40217 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by a race condition in the SSLSocket module. When the...