PT-2023-2564 · Illumina · Illumina Universal Copy Service

Name of the Vulnerable Software and Affected Versions: Illumina Universal Copy Service versions 2.x Description: The issue is related to the binding of Illumina Universal Copy Service to an unrestricted IP address, allowing an unauthenticated malicious actor to use the service to listen on all IP...

CVE-2023-29200 contao/core-bundle has path traversal vulnerability in the file manager

Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao...

SUSE-SU-2023:2003-1 Security update for runc

This update for runc fixes the following issues: Update to runc v1.1.5: Security fixes: - CVE-2023-25809: Fixed rootless /sys/fs/cgroup is writable when cgroupns isn't unshared bnc1209884. - CVE-2023-27561: Fixed regression that reintroduced CVE-2019-19921 vulnerability bnc1208962. -...

PT-2023-05: Unauth Buffer Overflow in sdwan_iface_ipc in Zyxel products

An issue was identified in Zyxel products affecting: ATP ZLD V5.10V5.32; USG FLEX ZLD V5.00V5.32; USG FLEX 50W/ USG20W-VPN ZLD V5.10V5.32; VPN ZLD V5.00V5.35. The discovered vulnerability of Buffer Overflow in sdwanifaceipc can be exploited by an unauthenticated attacker to dump the core with a...

Security Bulletin: IBM Safer Payments is vulnerable to multiple OpenSSL vulnerabilities (CVE-2021-23839, CVE-2021-23840, CVE-2021-23841)

Summary IBM Safer Payments uses OpenSSL. These OpenSSL vulnerabilities are addressed in IBM Safer Payments. Vulnerability Details CVEID:CVE-2021-23839 DESCRIPTION: OpenSSL could provide weaker than expected security, caused by incorrect SSLv2 rollback protection that allows for the inversion of t...

PT-2023-18564 · Alf.Io · Alf.Io

Name of the Vulnerable Software and Affected Versions: alfio-event/alf.io versions prior to 2.0-M4-2304 Description: The issue is related to the improper neutralization of formula elements in a CSV file. This problem affects the GitHub repository alfio-event/alf.io. Recommendations: For versions...

PT-2023-23126 · Unknown · Repetier Server

Name of the Vulnerable Software and Affected Versions: Repetier Server versions prior to 1.4.11 Description: The issue allows for execution as SYSTEM, which can be exploited for full compromise when combined with other vulnerabilities. Recommendations: For Repetier Server versions prior to 1.4.11...

PT-2023-19238 · WordPress · Google Maps V3 Shortcode

Name of the Vulnerable Software and Affected Versions: Google Maps v3 Shortcode plugin versions prior to 1.2.2 Description: The issue is related to a Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This type of vulnerability allows attackers to...

PT-2023-21114 · Unknown · James Irving-Swift Electric Studio Client Login

Name of the Vulnerable Software and Affected Versions: James Irving-Swift Electric Studio Client Login plugin versions prior to 0.8.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This type of vulnerability allo...

PT-2023-19155 · WordPress · George Gecewicz Portfolio Slideshow

Name of the Vulnerable Software and Affected Versions: George Gecewicz Portfolio Slideshow plugin versions prior to 1.13.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This type of vulnerability allows...

PT-2023-20488 · Flowmon · Flowmon Packet Investigator

Name of the Vulnerable Software and Affected Versions: Flowmon Packet Investigator versions prior to 12.1.0 Description: A path-traversal issue allows a Flowmon user with access to Flowmon Packet Investigator to retrieve files on the Flowmon appliance's local filesystem. Recommendations: For...

PT-2023-18187 · Nunjucks +1 · Nunjucks +1

Name of the Vulnerable Software and Affected Versions: Nunjucks versions prior to 3.2.4 Description: The issue allows bypassing the restrictions provided by the autoescape functionality in Nunjucks. If two user-controlled parameters are on the same line in the views, it is possible to inject...

SUSE-SU-2023:1903-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: grafana version update from 8.5.20 to 8.5.22: - Security issues fixed: CVE-2023-1410: Fix XSS in Graphite functions tooltip bsc1209645 CVE-2023-0507: Apply attribute sanitation to GeomapPanel bsc1208821 CVE-2023-0594: Avoid storing XSS in TraceView panel...

SUSE-SU-2023:1902-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: grafana version update from 8.5.20 to 8.5.22: - Security issues fixed: CVE-2023-1410: Fix XSS in Graphite functions tooltip bsc1209645 CVE-2023-0507: Apply attribute sanitation to GeomapPanel bsc1208821 CVE-2023-0594: Avoid storing XSS in TraceView panel...

PT-2023-3564

Name of the Vulnerable Software and Affected Versions kernel-image-rpi-un version 6.1.77-alt1 Linux Kernel versions =5.4 kernel-image-std-def version 5.10.179-alt1 Linux Kernel 5.3.18-150200 24 166 Description The Linux kernel is susceptible to a vulnerability stemming from an incorrect verifier...

Design/Logic Flaw

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with " double...

PT-2023-14542 · WordPress · Gus Sevilla Wp Clictracker

Name of the Vulnerable Software and Affected Versions: Gus Sevilla WP Clictracker plugin versions 1.0.5 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Gus Sevilla WP...

PT-2023-21310 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.106 Description: A SQL injection issue was found in DedeCMS via the component /dede/sys sql query.php. This allows for potential exploitation. Recommendations: For DedeCMS version 5.7.106, update to a version that fixes th...

PT-2023-22767 · Nextcloud · Nextcloud Talk

Name of the Vulnerable Software and Affected Versions: Nextcloud Talk versions prior to 15.0.5 Description: The issue allows a user added later to a conversation to access data that was deleted before they were added. This is a problem in Nextcloud Talk, a chat, video, and audio call extension fo...

PT-2023-17820 · Unknown · Easyappointments

Name of the Vulnerable Software and Affected Versions: alextselegidis/easyappointments versions prior to 1.5.0 Description: The issue is related to stored Cross-site Scripting XSS in the GitHub repository alextselegidis/easyappointments. A patch is available, and it is anticipated to be part of...