PT-2023-13776 · Ibm · Ibm Sterling B2B Integrator Standard Edition

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0 through 6.0.3.7 IBM Sterling B2B Integrator Standard Edition versions 6.1.0.0 through 6.1.2.0 Description: The issue is related to improper access controls, which could allow an...

GHSA-R6CH-MQF9-QC9W Regular Expression Denial of Service in Headers

Impact The Headers.set and Headers.append methods are vulnerable to Regular Expression Denial of Service ReDoS attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize utility function...

CVE-2023-25153 containerd OCI image importer memory exhaustion

containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug h...

PT-2023-13472 · Intel · Fcs Server

Name of the Vulnerable Software and Affected Versions: FCS Server software maintained by Intel versions prior to 1.1.79.3 Description: The issue is related to an uncaught exception in the FCS Server software, which may allow a privileged user to potentially enable denial of service via physical...

PT-2023-13483 · Intel · Intel Ethernet Network Controllers/Adapters E810 Series +1

Name of the Vulnerable Software and Affected Versions: IntelR Ethernet Network Controllers and Adapters E810 Series versions prior to 1.7.0.8 IntelR Ethernet 700 Series Controllers and Adapters versions prior to 9.101 Description: The issue is related to an out-of-bounds write in firmware, which...

SUSE CVE-2022-35990

TensorFlow is an open source platform for machine learning. When tf.quantization.fakequantwithminmaxvarsperchannelgradient receives input min or max of rank other than 1, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit...

squid security update

7:4.15-3.0.3.1 - Add libtool-ltdl to squid Requires: Orabug: 34992040 - 7:4.15-3.0.1.1 - Obsolete squid-sysvinit Jira: OLDIS-20090 7:4.15-3.1 - Resolves: 2100782 - CVE-2021-46784 squid:4/squid: DoS when processing gopher server responses 7:4.15-3 - Resolves: 1941506 - CVE-2021-28116 squid:4/squid...

SA43582 - Out-of-Cycle Advisory: Virtual Traffic Manager (vTM) Password Management Vulnerability/Sensitive Data Protection Vulnerability/Principle Of Least Privilege Violation

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A vulnerability in vTM could allow an remote attacker to gain unauthorized access to a targeted system. The vulnerability is due to an insufficiently secure derivation method for the zc...

PT-2023-16552 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 1.5.17 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input without proper validation, allowing attackers to inject malicious scripts. Thi...

PT-2023-12564 · Mruby +1 · Mruby +1

Name of the Vulnerable Software and Affected Versions: mruby versions prior to 3.1.0-rc Description: An Untrusted Pointer Dereference was discovered in the mrb vm exec function, causing a segmentation fault and application crash. Recommendations: For versions prior to 3.1.0-rc, update to version...

CVE-2023-25159 Nextcloud Server previews are accessible without a watermark

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform. Nextcloud Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, Nextcloud Enterprise Server 24.0.x prior to 24.0.8 and...

PT-2023-16123 · WordPress · Wp Yelp Review Slider

Name of the Vulnerable Software and Affected Versions: WP Yelp Review Slider WordPress plugin versions prior to 7.1 Description: The issue is related to a SQL injection that occurs due to improper sanitization and escaping of a parameter before it is used in a SQL statement. This can be exploited...

PT-2023-35126 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.92 Description: The issue is related to an incorrect offset calculation in the erofs/zmap.c file. The actual impact and attack plausibility have not yet been proven. Recommendations: For versions prior to...

PT-2023-35268 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.164 Description: A potential security issue exists due to a pci device refcount leak in the ixgbe module. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kern...

PT-2023-35159 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.91 Description: A use-after-free issue exists in the local cleanup function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v5.15.91...

PT-2023-35248 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.165 Description: A use-after-free race condition exists in the fastrpc component for maps. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions pri...

PT-2023-15995 · WordPress · Customer Reviews For Woocommerce

Name of the Vulnerable Software and Affected Versions: Customer Reviews for WooCommerce WordPress plugin versions prior to 5.16.0 Description: The issue allows users with a contributor role and above to include arbitrary files via a traversal attack due to a lack of validation in one of its...

PT-2023-34998 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.9 Description: The issue concerns a node refcount leak in the fwnode graph get next endpoint function. This problem was introduced in version v5.15 and is fixed in Linux Kernel version v6.1.9. The actual...

PT-2023-35117 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.93 Description: A harden sanity check issue in squashfs read xattr id table was identified. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2023-35096 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to a use-after-free UAF vulnerability in the drm/virtio component. It was introduced in version v4.4 and fixed in version v6.1.7. The actual impact and attack plausibilit...