SUSE-SU-2023:4709-1 Security update for go1.21

This update for go1.21 fixes the following issues: Update to go1.21.5: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme bsc1217834. - CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 bsc1216943. - CVE-2023-39326: net/http:...

PT-2023-20533

Name of the Vulnerable Software and Affected Versions pubnub versions prior to 7.4.0 com.pubnub:pubnub all versions github.com/pubnub/go all versions github.com/pubnub/go/v7 versions prior to 7.2.0 pubnub/pubnub versions prior to 6.1.0 pubnub/c-core versions prior to 4.5.0 com.pubnub:pubnub-kotli...

PT-2023-31151 · Microsoft · Microsoft-Graph-Core

Name of the Vulnerable Software and Affected Versions: microsoft-graph-core versions prior to 2.0.2 Description: The Microsoft Graph Beta PHP SDK contains test code that enables the use of the phpInfo function from any application that can access and execute the file at...

PT-2023-29402 · Softiron · Softiron Hypercloud

Name of the Vulnerable Software and Affected Versions: SoftIron HyperCloud versions 2.0.0 through 2.0.2 Description: An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process. In this instance, workloads may be...

PT-2023-8747

Name of the Vulnerable Software and Affected Versions jose4j versions prior to 0.9.4 Description The issue is related to the improper implementation of the PBES2 algorithm in the jose4j component when handling the p2c parameter. This can allow a remote attacker to cause a denial of service due to...

PT-2023-28297 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS versions prior to 1.11.24 Description: The issue concerns an unrestricted file upload in the /main/inc/ajax/document.ajax.php endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by...

PT-2023-30706 · Ezviz +1 · Ezviz Cs-C6Cn +3

Name of the Vulnerable Software and Affected Versions: Ezviz CS-C6N-xxx versions prior to v5.3.x build 20230401 Ezviz CS-CV310-xxx versions prior to v5.3.x build 20230401 Ezviz CS-C6CN-xxx versions prior to v5.3.x build 20230401 Ezviz CS-C3N-xxx versions prior to v5.3.x build 20230401 Hikvision...

Important: Red Hat Bug Fix Advisory: RHODS 2.4 - Red Hat OpenShift Data Science

Updated images are now available for Red Hat OpenShift Data Science. Release of RHODS 2.4 provides these changes:...

PT-2023-32443 · WordPress · Post Smtp Mailer

Name of the Vulnerable Software and Affected Versions: POST SMTP Mailer WordPress plugin versions prior to 2.7.1 Description: The issue allows an unauthenticated attacker to perform XSS attacks against highly privileged users by not escaping email message content before displaying it in the...

PT-2023-23576 · Unknown · Oroplatform

Name of the Vulnerable Software and Affected Versions: OroPlatform versions prior to 5.1.1 Description: The issue affects the OroPlatform package, which is used for system and user calendar management. It allows back-office users to access information from any system calendar event, bypassing ACL...

PT-2023-30018 · WordPress · Kk Star Ratings

Name of the Vulnerable Software and Affected Versions: kk Star Ratings WordPress plugin versions prior to 5.4.6 Description: The issue allows a user to vote multiple times on a poll due to a Race Condition, as the plugin does not implement atomic operations. Recommendations: For versions prior to...

[SECURITY] [DLA 3667-1] python-requestbuilder PEP440 version update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3667-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès November 26, 2023 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 3666-1] reportbug PEP440 version update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3666-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès November 26, 2023 https://wiki.debian.org/LTS -...

PT-2023-30607 · WordPress · Layerslider

Name of the Vulnerable Software and Affected Versions: LayerSlider plugin versions prior to 7.7.9 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations: For versions prior to 7.7.9, update to versi...

PT-2023-30601 · WordPress · Wpdiscuz

Name of the Vulnerable Software and Affected Versions: wpDiscuz plugin versions prior to 7.6.11 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web applicati...

PT-2023-30619 · Unknown · Themepoints Accordion

Name of the Vulnerable Software and Affected Versions: Themepoints Accordion plugin versions prior to 2.7 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations: For Themepoints Accordion plugin...

PT-2023-20708 · Accesspress Themes · Accesspress Themes Social Auto Poster

Name of the Vulnerable Software and Affected Versions: AccessPress Themes Social Auto Poster plugin versions = 2.1.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a...

PT-2023-30596 · WordPress · Fla-Shop.Com Interactive World Map

Name of the Vulnerable Software and Affected Versions: Fla-shop.Com Interactive World Map plugin versions prior to 3.2.0 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations: For versions prior to...

PT-2023-30612 · Leadster · Leadster

Name of the Vulnerable Software and Affected Versions: Leadster plugin versions prior to 1.1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web applicatio...

PYSEC-2023-288

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are...