CVE-2023-25152 Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on the host system that previously did not exist, potentially allowing attackers to change their resource allocations, promote their...

J-BusinessDirectory, 5.7.7 and prior, Other

In the J-BusinessDirectory version 5.8.3 we have updated guzzlehttp to the latest version, 7.5.0 and to PSR 2.1.5...

CVE-2023-23942 Self reflected HTML injection in Desktop client

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation...

GHSA-FXQX-XGQQ-GF42 Exposure of Sensitive Information in EVE-SRP

A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It has been rated as problematic. This issue affects some unknown processing of the file src/evesrp/views/api.py of the component User Information Handler. The manipulation leads to information disclosure. The attack may ...

CVE-2014-125086 Gimmie Plugin trigger_login.php sql injection

A vulnerability has been found in Gimmie Plugin 1.2.2 on vBulletin and classified as critical. Affected by this vulnerability is an unknown functionality of the file triggerlogin.php. The manipulation of the argument userid leads to sql injection. Upgrading to version 1.3.0 is able to address thi...

PT-2023-10154 · Unknown · Gimmie Plugin

Name of the Vulnerable Software and Affected Versions: Gimmie Plugin version 1.2.2 Description: A critical issue has been found in the Gimmie Plugin, affecting an unknown functionality of the file trigger login.php. The manipulation of the userid argument leads to sql injection. Upgrading to...

PT-2023-1573 · Unknown · Gimmie Plugin

Name of the Vulnerable Software and Affected Versions: Gimmie Plugin version 1.2.2 Description: The issue is related to a lack of protection in the SQL query structure, which can be exploited to execute arbitrary SQL queries. This is a critical vulnerability that affects the processing of the fil...

CVE-2018-25079

A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version...

Cross site scripting

A vulnerability classified as problematic was found in NREL api-umbrella-web 0.7.1. This vulnerability affects unknown code of the component Flash Message Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.0 is able to address...

PT-2023-16422

Name of the Vulnerable Software and Affected Versions libjxl versions prior to 0.8.1 Description An out of bounds read exists in libjxl. An attacker using a specifically crafted file could cause an out of bounds read in the exif handler. Recommendations For versions prior to 0.8.1, we recommend...

OESA-2023-1059 git security update

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce, and...

Security Bulletin: Vulnerability in jQuery affects IBM Process Mining (Multiple CVEs)

Summary There are multiple vulnerabilities in JQuery that could allow an attacker to launch cross-site scripting. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2015-9251 DESCRIPTION: jQuer...

CVE-2022-44645 Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability

In Apache Linkis =1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameter...

PT-2023-34822 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.90 Description: The issue concerns the axi chan handle err function, which lacks exception protection processing for vd. This could potentially lead to security vulnerabilities, although the actual impact...

PT-2023-1850 · Libde265 +4 · Libde265 +4

Name of the Vulnerable Software and Affected Versions: libde265 version 1.0.10 Description: The issue is related to a NULL pointer dereference in the ff hevc put weighted pred avg 8 sse function at sse-motion.cc in the libde265 video codec implementation. This allows attackers to cause a Denial o...

PT-2023-18680 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.1 Discourse version 3.1.0.beta2 and earlier Description: Discourse is an open source platform for community discussion. The issue is related to Allocation of Resources Without Limits or Throttling, where a...

PT-2023-1227 · Vim +8 · Vim +8

Name of the Vulnerable Software and Affected Versions: Vim versions prior to 9.0.1225 Description: The issue is related to a heap-based buffer overflow in the Vim text editor, specifically affecting functions such as same leader and utfc ptr2len. This can allow an attacker to execute arbitrary co...

DEBIAN-CVE-2023-22742

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the certificatecheck field of libgit2's gitremotecallbacks...

CVE-2023-22726 Unrestricted file upload leading to privilege escalation in act

act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege...

CVE-2023-22458 Integer overflow in multiple Redis commands can lead to denial-of-service

Redis is an in-memory database that persists on disk. Authenticated users can issue a HRANDFIELD or ZRANDMEMBER command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not...