PT-2023-21398 · Rami.Io · Pretix

Name of the Vulnerable Software and Affected Versions: rami.io pretix versions prior to 4.15.1 rami.io pretix versions 4.15.1 through 4.16.0 rami.io pretix versions 4.16.1 through 4.17.0 Description: The issue allows OAuth application authorization from a logged-out session. Recommendations: For...

PT-2023-16378

Name of the Vulnerable Software and Affected Versions ASOS Information Technologies SOBIAD versions prior to 23.02.01 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Cross-Site Scripting XSS...

SUSE-SU-2023:0604-1 Security update for python-cryptography, python-cryptography-vectors

This update for python-cryptography, python-cryptography-vectors fixes the following issues: - Update in SLE-15 bsc1199282, jscPM-3243, jscSLE-24629 - CVE-2020-36242: Fixed a bug where certain sequences of update calls could result in integer overflow bsc1182066. - CVE-2020-25659: Fixed...

SUSE-SU-2023:0603-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: Updated to version 20230222.00 bsc1202100, bsc1202101 and bumped go API version to 1.18 to address the following bsc1208723: - CVE-2021-38297: Fixed data overwrite when passing large arguments to GOARCH=wasm GOOS=js bsc1191468. -...

PT-2023-16000 · WordPress · Metform Elementor Contact Form Builder

Name of the Vulnerable Software and Affected Versions: Metform Elementor Contact Form Builder plugin for WordPress versions up to, and including, 3.2.1 Description: The issue is related to insufficient server-side checking of the captcha value submitted during form submission, allowing...

PT-2023-20668 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 6.3-rc-1 through 13.10.9 XWiki Platform versions 6.2.4 through 14.4.5 XWiki Platform versions 14.4.6 is not affected, but versions prior to 14.4.6 are Description: The issue allows injecting arbitrary wiki syntax,...

PT-2023-16779 · Flatpress · Flatpress

Name of the Vulnerable Software and Affected Versions: flatpress versions prior to 1.3 Description: The issue is related to Cross-site Scripting XSS - Generic in the GitHub repository flatpressblog/flatpress. Recommendations: For versions prior to 1.3, update to version 1.3 or later to resolve th...

PT-2023-20453 · Gradle · Gradle

Name of the Vulnerable Software and Affected Versions: Gradle versions prior to 6.9.4 Gradle versions prior to 7.6.1 Gradle versions prior to 8.0 Description: This issue is a collision attack on long IDs 64bits for PGP keys. Users of dependency verification in Gradle are vulnerable if they use lo...

CVE-2022-39228 Observable Response Discrepancy in vantage6

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is...

PT-2023-16731

Name of the Vulnerable Software and Affected Versions Uzay Baskul Weighbridge Automation Software versions prior to 1.1 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2023-19338 · Wow Company · Wow-Company Bubble Menu

Name of the Vulnerable Software and Affected Versions: Wow-Company Bubble Menu – circle floating menu plugin versions = 3.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which can lead to form deletion. Recommendations: For Wow-Company Bubble Menu – circle floating...

PT-2023-16192 · Forgerock · Forgerock Access Management Web Policy Agent

Name of the Vulnerable Software and Affected Versions: ForgeRock Access Management Web Policy Agent versions up to 5.10.1 Description: The issue is related to a Relative Path Traversal vulnerability that allows Authentication Bypass in the ForgeRock Access Management Web Policy Agent...

SUSE-SU-2023:0527-1 Security update for php8

This update for php8 fixes the following issues: php8 was updated to version 8.0.28: - CVE-2023-0568: Fixed NULL byte off-by-one in phpcheckspecificopenbasedir bnc1208366. - CVE-2023-0662: Fixed DoS vulnerability when parsing multipart request body bnc1208367...

PT-2023-2088 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.18 Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability in the pimcore/pimcore GitHub repository. This vulnerability is associated with the blacklistAction function, whi...

PT-2023-2004 · Hitachi · Hitachi Ops Center Analyzer

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Analyzer versions 10.9.0-00 through 10.9.0-00 Description: The issue is related to incorrect default permissions in the Hitachi Ops Center Analyzer RAID Agent component, allowing local users to read and write specific files...

PT-2023-16385 · WordPress · All In One Seo Pack

Name of the Vulnerable Software and Affected Versions: All in One SEO Pack plugin for WordPress versions up to, and including, 4.2.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with...

CVE-2023-25621 Apache Sling does not allow to handle i18n content in a secure way

Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it allows an author to change any text or...

PT-2023-15030 · Squaredup · Squaredup Dashboard Server Scom Edition

Name of the Vulnerable Software and Affected Versions: SquaredUp Dashboard Server SCOM edition versions prior to 5.7.1 GA Description: The issue allows for XSS. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world...

USN-5739-2 mariadb-10.3, mariadb-10.6 regression

USN-5739-1 fixed vulnerabilities in MariaDB. It caused a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: MariaDB has been updated to 10.3.38 in Ubuntu 20.04 LTS and to 10.6.12 in Ubuntu 22.04 LTS and Ubuntu 22.10...

SUSE-SU-2023:0469-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Updated to version 102.8.0 ESR bsc1208144: - CVE-2023-25728: Fixed content security policy leak in violation reports using iframes. - CVE-2023-25730: Fixed screen hijack via browser fullscreen mode. - CVE-2023-25743: Fixed Fullscreen...