PT-2023-16779 · Flatpress · Flatpress

Name of the Vulnerable Software and Affected Versions: flatpress versions prior to 1.3 Description: The issue is related to Cross-site Scripting XSS - Generic in the GitHub repository flatpressblog/flatpress. Recommendations: For versions prior to 1.3, update to version 1.3 or later to resolve th...

PT-2023-20453 · Gradle · Gradle

Name of the Vulnerable Software and Affected Versions: Gradle versions prior to 6.9.4 Gradle versions prior to 7.6.1 Gradle versions prior to 8.0 Description: This issue is a collision attack on long IDs 64bits for PGP keys. Users of dependency verification in Gradle are vulnerable if they use lo...

CVE-2022-39228 Observable Response Discrepancy in vantage6

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is...

PT-2023-16731

Name of the Vulnerable Software and Affected Versions Uzay Baskul Weighbridge Automation Software versions prior to 1.1 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2023-19338 · Wow Company · Wow-Company Bubble Menu

Name of the Vulnerable Software and Affected Versions: Wow-Company Bubble Menu – circle floating menu plugin versions = 3.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which can lead to form deletion. Recommendations: For Wow-Company Bubble Menu – circle floating...

PT-2023-16192 · Forgerock · Forgerock Access Management Web Policy Agent

Name of the Vulnerable Software and Affected Versions: ForgeRock Access Management Web Policy Agent versions up to 5.10.1 Description: The issue is related to a Relative Path Traversal vulnerability that allows Authentication Bypass in the ForgeRock Access Management Web Policy Agent...

SUSE-SU-2023:0527-1 Security update for php8

This update for php8 fixes the following issues: php8 was updated to version 8.0.28: - CVE-2023-0568: Fixed NULL byte off-by-one in phpcheckspecificopenbasedir bnc1208366. - CVE-2023-0662: Fixed DoS vulnerability when parsing multipart request body bnc1208367...

PT-2023-2088 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.18 Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability in the pimcore/pimcore GitHub repository. This vulnerability is associated with the blacklistAction function, whi...

PT-2023-2004 · Hitachi · Hitachi Ops Center Analyzer

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Analyzer versions 10.9.0-00 through 10.9.0-00 Description: The issue is related to incorrect default permissions in the Hitachi Ops Center Analyzer RAID Agent component, allowing local users to read and write specific files...

PT-2023-16385 · WordPress · All In One Seo Pack

Name of the Vulnerable Software and Affected Versions: All in One SEO Pack plugin for WordPress versions up to, and including, 4.2.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with...

CVE-2023-25621 Apache Sling does not allow to handle i18n content in a secure way

Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it allows an author to change any text or...

PT-2023-15030 · Squaredup · Squaredup Dashboard Server Scom Edition

Name of the Vulnerable Software and Affected Versions: SquaredUp Dashboard Server SCOM edition versions prior to 5.7.1 GA Description: The issue allows for XSS. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world...

USN-5739-2 mariadb-10.3, mariadb-10.6 regression

USN-5739-1 fixed vulnerabilities in MariaDB. It caused a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: MariaDB has been updated to 10.3.38 in Ubuntu 20.04 LTS and to 10.6.12 in Ubuntu 22.04 LTS and Ubuntu 22.10...

SUSE-SU-2023:0469-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Updated to version 102.8.0 ESR bsc1208144: - CVE-2023-25728: Fixed content security policy leak in violation reports using iframes. - CVE-2023-25730: Fixed screen hijack via browser fullscreen mode. - CVE-2023-25743: Fixed Fullscreen...

PT-2023-11824 · WordPress · Spectra

Name of the Vulnerable Software and Affected Versions: Spectra WordPress plugin versions prior to 1.15.0 Description: The issue allows contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks due to insufficient sanitization of user input in the style HTML attribute...

PT-2023-16229 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads WordPress plugin versions prior to 3.1.0.5 Description: The issue concerns the lack of validation and escaping of certain block options in the Easy Digital Downloads WordPress plugin, which could allow users with the...

PT-2023-16363 · WordPress · Gs Portfolio

Name of the Vulnerable Software and Affected Versions: GS Portfolio for Envato WordPress plugin versions prior to 1.4.0 Description: The issue concerns the GS Portfolio for Envato WordPress plugin, which does not properly validate and escape certain shortcode attributes before outputting them in ...

PT-2023-12187 · Vditor · Vditor

Name of the Vulnerable Software and Affected Versions: Vditor versions prior to 3.8.7 Description: Vditor is a browser-side Markdown editor. The issue at hand is a copy-paste cross-site scripting XSS problem. For this particular type of XSS, the victim needs to be fooled into copying a malicious...

PT-2023-12183 · Unknown · Mind-Elixir

Name of the Vulnerable Software and Affected Versions: Mind-elixir versions prior to 0.18.1 Description: The issue is related to cross-site scripting when handling untrusted menus in Mind-elixir, a free, open source mind map core. Recommendations: For versions prior to 0.18.1, update to version...

PT-2023-16616 · Pixelfed · Pixelfed

Name of the Vulnerable Software and Affected Versions: pixelfed/pixelfed versions prior to 0.11.4 Description: The issue is related to improper authorization in the GitHub repository pixelfed/pixelfed. Recommendations: For versions prior to 0.11.4, update to version 0.11.4 or later to resolve the...