Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass. Under rare conditions, a restart of Umbraco can allow unauthorized users to gain admin-level permissions. Workaround 1 Enabling the Unattended Install feature will mean the vulnerability is not exploitable. 2...

PT-2023-24415 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: Gitlab CE/EE versions 13.6 through 15.11.10 Gitlab CE/EE versions 16.0 through 16.0.6 Gitlab CE/EE versions 16.1 through 16.1.1 Description: An information disclosure issue resulted in the Sidekiq log including webhook tokens when the log...

PYSEC-2023-119

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL.It is recommended to upgrade to a version that is not affected...

PT-2023-24633 · Woocommerce · Pi Websolution Conditional Shipping & Advanced Flat Rate Shipping Rates / Flexible Shipping

Name of the Vulnerable Software and Affected Versions: PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin versions = 1.6.4.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an...

PT-2023-25680 · Unknown · Andrea Tarantini Menubar

Name of the Vulnerable Software and Affected Versions: Andrea Tarantini Menubar plugin versions = 5.8.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

Access Restriction Bypass

Overview Microsoft.AspNetCore.App.Runtime.win-x86 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Access Restriction Bypass. A vulnerability exist in...

Access Restriction Bypass

Overview Affected versions of this package are vulnerable to Access Restriction Bypass. A vulnerability exist in ASP.NET Core applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords. Remediation Upgrade...

Barberry Security Advisory - regarding x/auth periodic vesting accounts

Impact In PeriodicVestingAccount, defined in x/auth, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds are locked forever, and the user is not able t...

GHSA-4VVM-4W3V-6MR8 pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if parsecontentstream is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the...

SUSE CVE-2023-36464

pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if parsecontentstream is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request 969 and resolv...

PT-2023-4819 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 14.6RC1 through 14.10.5 XWiki versions prior to 15.2RC1 Description: The issue arises from the HTML sanitizer in XWiki, which allowed form and input HTML tags since version 14.6RC1. This enables an attacker without script right...

PT-2023-18454 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.2.0p4 Description: The issue allows an authenticated attacker to enumerate usernames through user enumeration. Recommendations: For versions prior to 2.2.0p4, update to a version that contains a fix for this issue...

PT-2023-22484 · Laravel-S · Laravel-S

Name of the Vulnerable Software and Affected Versions: laravel-s versions prior to 3.7.36 Description: The issue is related to Local File Inclusion, which can be exploited via the /src/Illuminate/Laravel.php API endpoint. Recommendations: For versions prior to 3.7.36, update to version 3.7.36 or...

PT-2023-24244 · WordPress · Cms Commander

Name of the Vulnerable Software and Affected Versions: CMS Commander plugin for WordPress versions up to, and including, 2.287 Description: The issue is related to an authorization bypass vulnerability due to the use of an insufficiently unique cryptographic signature on the cmsc add site functio...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization due to improper authorization checks. A low-privileged attacker can bypass certain security features by exploiting these checks. Remediation Upgrade...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization due to improper handling of authorization logic. An attacker can bypass security measures and access sensitive user data without requiring user...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the comliferaylayoutadminwebportletGroupPagesPortletbackURL parameter in the SEO configuration of the Layout module. An attacker can cause users to be redirected to arbitrary external URLs by tricking them into clickin...

PT-2023-4869

Name of the Vulnerable Software and Affected Versions snappy-java versions prior to 1.1.10.1 Description The issue is related to an integer overflow in the compresschar input function of the snappy-java library, which can cause an unrecoverable fatal error. This occurs when the length of the inpu...

CVE-2023-34449 ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`

ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through CallBuilder::delegate or...

Arbitrary Code Execution

Overview runtime.win-x64.Microsoft.NETCore.App is an internal implementation package not meant for direct consumption Affected versions of this package are vulnerable to Arbitrary Code Execution. A vulnerability exists in .NET during crash and stack trace scenarios that could lead to loading...