PT-2023-18345 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 15.9.8 GitLab versions 15.10.0 through 15.10.7 GitLab versions 15.11.0 through 15.11.3 Description: A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would...

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow via the component PoDoFo::PdfEncryptAESV3::PdfEncryptAESV3. Remediation Upgrade podofo to version 0.10.4 or higher. References - GitHub Commit - GitHub Issue Credit: longuu9...

PT-2023-23594 · Etcd +3 · Etcd +3

Name of the Vulnerable Software and Affected Versions: etcd versions prior to 3.4.26 and prior to 3.5.9 Description: The issue is related to insufficient protection of service data in etcd, a distributed key-value store. The LeaseTimeToLive API allows access to key names associated with a lease...

CVE-2023-31139 DHIS2 Core unrestricted session cookies with Personal Access Tokens

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens PATs generate unrestricted session cookies. This may lead to a bypass of other access...

CVE-2023-31138 DHIS2 Core vulnerable to Improper Access Control with PATCH requests

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authenticated users with write access to an obje...

CVE-2023-31126 Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml

org.xwiki.commons:xwiki-commons-xml is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability does not affect...

PT-2023-8607 · Xwiki · Xwiki-Commons-Xml

Name of the Vulnerable Software and Affected Versions: org.xwiki.commons:xwiki-commons-xml versions 14.6-rc-1 through 14.10.3 org.xwiki.commons:xwiki-commons-xml versions prior to 15.0 RC1 Description: The HTML sanitizer in the org.xwiki.commons:xwiki-commons-xml library allows the injection of...

CVE-2023-31125 Uncaught exception in engine.io

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the socket.io parent package. Older versions are not impacted. A...

PT-2023-10350 · Php-Login · Php-Login

Name of the Vulnerable Software and Affected Versions: PHP-Login version 1.0 Description: A critical issue was found in the function checkLogin of the file login/scripts/class.loginscript.php within the POST Parameter Handler component. The manipulation of the myusername argument can lead to SQL...

Improper Encoding or Escaping of Output

Overview std/html/template is a Go standard library package std/html/template Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output. Go Vulnerability Report:Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing...

SUSE-SU-2023:2097-1 Security update for maven and recommended update for antlr3, minlog, sbt, xmvn

This update for antlr3, maven, minlog, sbt, xmvn fixes the following issues: maven: - Version update from 3.8.5 to 3.8.6 jscSLE-23217: Security fixes: + CVE-2021-42550: Update Version of optional Logback bsc1193795 Bug fixes: + Fix resolver session containing non-MavenWorkspaceReader + Fix for...

PT-2023-18357 · Hashicorp · Hashicorp Vault Enterprise

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault Enterprise versions 1.13.0 through 1.13.1 Description: The issue concerns a padding oracle attack when using an HSM in conjunction with the CKM AES CBC PAD or CKM AES CBC encryption mechanisms. An attacker with privileges to...

PT-2023-20059 · Vtech · Vtech Vcs754

Name of the Vulnerable Software and Affected Versions: vTech VCS754 versions 1.1.1.A through 1.1.1.G Description: An issue was discovered that allows attackers to gain escalated privileges and gain sensitive information due to cleartext passwords passed in the raw HTML. Recommendations: For...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

UBUNTU-CVE-2023-0458

A speculative pointer dereference problem exists in the Linux Kernel on the doprlimit function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. This updat...

PT-2023-18670 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe Framework versions prior to 4.12.15 Description: An attacker can display a link to a third party website on a login screen by convincing a legitimate content author to follow a specially crafted link. Recommendations: For version...

PT-2023-22308 · Unknown · Huedawn-Tesseract +1

Name of the Vulnerable Software and Affected Versions: huedawn-tesseract version 0.3.3 dawnsparks-node-tesseract versions 0.4.0 through 0.4.1 Description: The issue is related to a remote code execution RCE vulnerability via the child process function. Recommendations: For huesdawn-tesseract...

PT-2023-22810

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.2 Description The issue allows users to upload attachments to test plans, test cases, etc., without control over the types of files that can be uploaded. A malicious actor may upload an .exe file or a file...

PT-2023-17684 · Unknown · Spring Boot

Name of the Vulnerable Software and Affected Versions: Spring Boot versions 3.0.0 through 3.0.5 Spring Boot versions 2.7.0 through 2.7.10 Spring Boot older unsupported versions Description: An application that is deployed to Cloud Foundry could be susceptible to a security bypass. Recommendations...