Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsin...

Fuji Electric Tellus Lite V-Simulator 6 V9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2023-32162 · WordPress · Delete Usermeta

Name of the Vulnerable Software and Affected Versions: Delete Usermeta plugin for WordPress versions up to, and including, 1.1.2 Description: The issue is due to missing nonce validation on the delumet options page function, making it possible for unauthenticated attackers to remove user meta for...

PT-2023-32562 · WordPress · Audio Merchant

Name of the Vulnerable Software and Affected Versions: The Audio Merchant plugin for WordPress versions up to, and including, 5.0.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the audio merchant add audio file function. This allo...

PT-2023-8633

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.0-M10 Apache Tomcat versions 10.1.0-M1 through 10.1.15 Apache Tomcat versions 9.0.0-M1 through 9.0.82 Apache Tomcat versions 8.5.0 through 8.5.95 Description The issue is related to an Improper Inp...

PT-2023-8115 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a possible out of bounds write in the OSMMapPMRGeneric function of pmr os.c, potentially leading to local escalation of privilege in the kernel. This could be...

curl: TELNET option IAC injection

A vulnerability in input validation exists in curl 8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform...

SUSE-SU-2023:4381-1 Security update for squid

This update for squid fixes the following issues: - CVE-2023-46846: Request/Response smuggling in HTTP/1.1 and ICAP bsc1216500. - CVE-2023-46847: Denial of Service in HTTP Digest Authentication bsc1216495. - CVE-2023-46724: Fix validation of certificates with CN= bsc1216803. - CVE-2023-46848:...

PT-2023-29445 · 1E · 1E-Exchange-Commandlineping

Name of the Vulnerable Software and Affected Versions: 1E-Exchange-CommandLinePing instruction versions prior to v18.1 Description: The 1E-Exchange-CommandLinePing instruction does not properly validate the input parameter, allowing for a specially crafted input to perform arbitrary code executio...

PT-2023-32434 · WordPress · Video Carousel Slider With Lightbox Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: video carousel slider with lightbox plugin for WordPress version 1.0 Description: The issue is due to missing or incorrect nonce validation on the responsive video gallery with lightbox video management func function, making it possible for...

SUSE CVE-2023-5482

Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Chromium security severity: High...

java-17-openjdk security and bug fix update

1:17.0.9.0.9-2.0.1 - Update to jdk-17.0.9+9 GA - Update release notes to 17.0.9+9 - OpenJDK: memory corruption issue on x8664 with AVX-512 JDK-8317121 CVE-2023-22025 - OpenJDK: certificate path validation issue during client authentication JDK-8309966 CVE-2023-22081 - OpenJDK: Additional zip64...

PT-2023-18136 · Bluetooth · Bluetooth

Name of the Vulnerable Software and Affected Versions: Bluetooth affected versions not specified Description: The issue is related to a possible out of bounds write in Bluetooth due to improper input validation. This could lead to local escalation of privilege, with System execution privileges...

PT-2023-14741 · Lenovo · Lenovo Thinkpad

Name of the Vulnerable Software and Affected Versions: Lenovo ThinkPad affected versions not specified Description: An SMI handler input validation issue in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code. Recommendation...

CVE-2023-5821

The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request granted they c...

PT-2023-6858 · Atlassian · Sourcetree

Name of the Vulnerable Software and Affected Versions: SourceTree affected versions not specified Description: The issue is related to insufficient input validation in the visual Git client SourceTree. Exploitation of this issue may allow an attacker to execute arbitrary code. Recommendations: At...

CVE-2023-4923 BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion

The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobebulkoperationsdelete function. This makes it possible for unauthenticated attackers to delete products via a forged reques...

CVE-2023-4935 BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Creation

The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the createprofile function. This makes it possible for unauthenticated attackers to create profiles via a forged request granted th...

CVE-2023-4940

The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobebulkoperationsswap function. This makes it possible for unauthenticated attackers to manipulate products via a forged...

Siemens Tecnomatix Plant Simulation IGS File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Tecnomatix Plant Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists withi...