OESA-2023-1648 mdadm security update

mdadm is a tool for managing Linux Software RAID arrays. It can create, assemble, report on, and monitor arrays. It can also move spares between raid arrays when needed. Security Fixes: Uncontrolled resource consumption in some IntelR SSD Tools software before version mdadm-4.2-rc2 may allow a...

CVE-2023-4661

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Saphira Saphira Connect allows SQL Injection. This issue affects Saphira Connect: before 9...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in versions prior to Discourse 3.1.1. An attacker exploiting this vulnerability could perform a denial-of-service attack...

LibreNMS Cross-Site Scripting Vulnerability

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments and automatic updates. A cross-site scripting vulnerability exists in versions prior to librenms 23.9.0. An...

DEBIAN-CVE-2023-4900

Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a permission prompt via a crafted HTML page. Chromium security severity: Medium...

Zoom Client Input Validation Error Vulnerability

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. An input validation error vulnerability exists in Zoom Client versions prior to 5.15.10, which stems from the presence of incorrect input validation that could allow an unauthenticated user to...

Dell SD ROM Utility Access Control Error Vulnerability

Dell SD ROM Utility is a tool from Dell USA that helps to permanently write-protect SD cards. An access control error vulnerability exists in Dell SD ROM Utility versions prior to 1.0.2.0, which can be exploited by an attacker to execute arbitrary code with limited access rights...

CVE-2023-37759

Incorrect access control in the User Registration page of Crypto Currency Tracker CCT before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request...

PT-2023-27903 · Unknown · Matrix Media Repo

Name of the Vulnerable Software and Affected Versions: matrix-media-repo versions prior to 1.3.0 Description: The issue allows an attacker to upload malicious media to the media repository, which is then served with Content-Disposition: inline upon download. This can be leveraged to execute scrip...

Contec SolarView Compact Path Traversal Vulnerability

Contec SolarView Compact is an application system from Contec Japan. It provides photovoltaic power measurement systems. A security vulnerability exists in SolarView Compact versions prior to 6.00 that stems from the presence of a directory traversal vulnerability...

JSCAPE MFT Server Code Issue Vulnerability

JSCAPE MFT Server is a flexible and scalable hosted file transfer solution from JSCAPE USA. A security vulnerability exists in JSCAPE MFT Server versions prior to 2023.1.9 that stems from the presence of insecure deserialization, which allows an attacker to run arbitrary Java code through its...

PT-2023-4991 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.25 Description: An authenticated SQL injection issue was discovered in Cacti, an open source operational monitoring and fault management framework. This issue allows authenticated users to perform privilege...

PT-2023-5423 · Cacti · Cacti

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.25 Description: Cacti is an open source operational monitoring and fault management framework. A low-privileged OS user with access to a Windows host where Cacti is installed can create arbitrary PHP files in a web...

PT-2023-24472

Name of the Vulnerable Software and Affected Versions Bookreen versions prior to 3.0.0 Description The issue affects Unisign Bookreen, allowing OS Command Injection due to an Unrestricted Upload of File with Dangerous Type vulnerability. Recommendations For versions prior to 3.0.0, update to...

UBUNTU-CVE-2023-4758

Buffer Over-read in GitHub repository gpac/gpac prior to 2.3-DEV...

PT-2023-27961 · WordPress · Store Locator

Name of the Vulnerable Software and Affected Versions: Store Locator WordPress plugin versions prior to 1.4.13 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly sanitise and escape an invalid nonce before outputting it ba...

SHIRASAGI Cross-Site Scripting Vulnerability

SHIRASAGI is a content management system CMS for the Japanese Shirasagi project. A security vulnerability exists in SHIRASAGI versions prior to v1.18.0. An attacker can exploit the vulnerability to execute arbitrary script on a web browser...

UBUNTU-CVE-2023-4678

Divide By Zero in GitHub repository gpac/gpac prior to 2.3-DEV...

UBUNTU-CVE-2023-4683

NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV...

CVE-2023-41738

Improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in Directory Domain Functionality in Synology Router Manager SRM before 1.3.1-9346-6 allows remote authenticated users to execute arbitrary commands via unspecified vectors...