CVE-2023-23623 Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a script-src directive and not providing unsafe-eval in that directive, is not respected in renderers that have sandb...

CVE-2023-40591 Denial of service via malicious p2p message in go-ethereum

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version 1.12.1-stable, i.e,...

PT-2023-32965 · Unknown · Cosmovisor

Name of the Vulnerable Software and Affected Versions: Cosmovisor versions prior to v1.0.0 Description: An issue has been identified in Cosmovisor that may result in a Denial of Service or Remote Code Execution path depending on configuration for a node or validator using the vulnerable version t...

CVE-2023-39362 Authenticated command injection in SNMP options of a Device

Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlyin...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

SUSE CVE-2023-39351

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX rfx handling. Inside the rfxprocessmessagetileset function, the program allocates tiles...

SUSE CVE-2023-40186

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the gdiCreateSurface function. This issue affects FreeRDP based clients only. FreeRDP proxies...

UBUNTU-CVE-2023-39355

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. Versions of FreeRDP on the 3.x release branch before beta3 are subject to a Use-After-Free in processing RDPGFXCMDIDRESETGRAPHICS packets. If context-maxPlaneSize is 0, context-planesBuffer wil...

Unable to set up HA in GUI after upgrading to 14.1

After upgrading to 14.1 4.42, when trying to add HA node from GUI, the following error will be thrown even RPC password is correct. Changing RPC password from GUI will not help to resolve this issue...

PT-2023-9132 · Synology · Video Station

Name of the Vulnerable Software and Affected Versions: Video Station versions prior to 5.7.2 Description: A SQL injection issue affects Video Station, related to a lack of protection against SQL query structure attacks. This could allow a remote attacker to execute arbitrary code by injecting...

PT-2023-27225 · Rust +4 · Rust +4

Name of the Vulnerable Software and Affected Versions: Rust versions 1.60.0 through 1.71 Description: The issue arises from Cargo not escaping Cargo feature names when including them in the report generated by cargo build --timings. This allows a malicious package included as a dependency to inje...

PT-2023-23588

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 0.17.1 Netmaker versions 0.18.0 through 0.18.5 Description Hardcoded DNS key usage has been found in Netmaker, allowing unauthorized users to interact with DNS API endpoints. The issue is patched in version 0.17.1 an...

SUSE-SU-2023:3385-1 Security update for janino

This update for janino fixes the following issues: janino was upgraded to version 3.1.10: - CVE-2023-33546: Fixed DoS due to missing error handling bsc1211923...

PT-2023-33041 · Silverstripe · Silverstripe Cms

Name of the Vulnerable Software and Affected Versions: Silverstripe CMS version 4 TinyMCE versions 4.x Description: The issue concerns several XSS vectors in TinyMCE 4.x that have been patched in later versions. These vulnerabilities affect silverstripe/admin and, by extension, Silverstripe CMS 4...

CVE-2022-44729

Server-Side Request Forgery SSRF vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even...

PT-2023-5194 · Gnu +7 · Binutils +7

Name of the Vulnerable Software and Affected Versions: Binutils versions prior to 2.39.3 Description: The issue is related to insufficient input validation in the bfd mach o get synthetic symtab function in match-o.c. This can allow attackers to cause a denial of service or other unspecified...

GHSA-23QF-3JF9-H3Q9 Apache NiFi Insufficient Property Validation vulnerability

Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custo...

SUSE-SU-2023:3341-1 Security update for postgresql12

This update for postgresql12 fixes the following issues: - Update to 12.16 - CVE-2023-39417: Fixed potential SQL injection for trusted extensions. bsc1214059...

PT-2023-27303 · Dispatch · Dispatch Plugin - Basic Authentication Provider +1

Name of the Vulnerable Software and Affected Versions: Dispatch versions prior to 20230817 Description: Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the Dispatch Plugin - Basic...

PT-2023-27301 · Unknown · Turbowarp Desktop

Name of the Vulnerable Software and Affected Versions: TurboWarp Desktop versions prior to 1.8.0 Description: TurboWarp is a desktop application that compiles scratch projects to JavaScript. The issue allows a malicious project or custom extension to read arbitrary files from disk and upload them...