PT-2023-8876 · Unknown +9 · Openpmix Pmix +9

Name of the Vulnerable Software and Affected Versions: OpenPMIx PMIx versions 4.2.6 and earlier, 5.0.x before 5.0.1 Description: The issue is related to a race condition during the execution of library code with UID 0, allowing attackers to obtain ownership of arbitrary files. This can potentiall...

PT-2023-25429 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS version 2.0.1 Description: An issue was discovered in IceCMS, allowing attackers to escalate privileges and gain sensitive information via the UserID parameter in the "api/User/ChangeUser" endpoint. Recommendations: For IceCMS version...

RLSA-2023:3714 Moderate: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: schemaelement defeats protective searchpath changes CVE-2023-2454 postgresql: row security policies disregard user ID changes after inlining. CVE-2023-2455 For more details about the security...

Rocky Linux 9 : postgresql (RLSA-2023:3714)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:3714 advisory. - schemaelement defeats protective searchpath changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with...

CVE-2023-40170

creationtimestamp| type| source ---|---|--- 2023-08-29 00:16:58+00:00| seen| https://t.me/cibsecurity/69321...

Lock User Account < 1.0.4- Arbitrary Account Lock/Unlock via CSRF

Description The plugin does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack Make a logged in admin open one of the links below, this will make them lock/unlock the user with ID 5...

PT-2023-29210 · Sourcecodester · Sourcecodester Inventory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Inventory Management System version 1.0 Description: A critical issue has been found in the processing of the file app/action/edit update.php, where the manipulation of the user id argument leads to sql injection. The attack ca...

Inventory Management System SQL注入漏洞

Inventory Management System is an inventory management system by stemword individual developers. Inventory Management System version 1.0 suffers from a SQL injection vulnerability that originates from the parameter userid in the file app/action/editupdate.php, which can lead to sql injection...

CLSA-2023-1692296244 Fix CVE(s): CVE-2023-30577

SECURITY UPDATE: privilege escalation through runtar SUID program - debian/patches/CVE-2023-30577.patch: introduce tar option allow list Fix changelog installation - CVE-2023-30577...

Kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid

...

CVE-2023-40303

GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of setid family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if the setuid system call fails when a process is trying to drop privileges before letting an ordinary us...

123.chat < 1.3.1 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup In the plugin's "User-ID" setting fiel...

Moderate: Red Hat Security Advisory: postgresql:10 security update

An update for the postgresql:10 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CentOS 8 : postgresql:12 (CESA-2023:4535)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:4535 advisory. - In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certa...

ALSA-2023:4539 Moderate: postgresql:10 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: schemaelement defeats protective searchpath changes CVE-2023-2454 postgresql: row security policies disregard user ID changes after inlining. CVE-2023-2455 For more details about the security...

CVE-2023-4183

A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file editupdate.php of the component Password Handler. The manipulation of the argument userid leads to improper access controls. The atta...

PT-2023-5894 · Sourcecodester · Sourcecodester Inventory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Inventory Management System version 1.0 Description: A vulnerability has been found in the SourceCodester Inventory Management System, affecting the file edit update.php of the component Password Handler. The manipulation of th...

Inventory Management System Access Control Error Vulnerability

Inventory Management System is an inventory management system by the individual developers of stemword. An Access Control Error vulnerability exists in the SourceCodester Inventory Management System version 1.0 due to incorrect access control of the userid parameter on the editupdate.php page via...

Matrix-appservice-bridge Authorization Issues Vulnerability

Matrix-appservice-bridge is an open source service. It is used to bridge application services for the Matrix communication program. Matrix-appservice-bridge suffers from an authorization issue vulnerability that stems from the fact that a malicious Matrix server can use an external user's MXID in...

linux kernel security vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the linux kernel that stems from initializing the next fix iuid of a socket UID to currentfsuid...