PT-2023-8375 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance version 10.0 Description: The issue is related to the use of hard-coded credentials, such as a password or cryptographic key, in IBM Security Verify Governance. This could allow a remote attacker to disclose...

PT-2023-29838 · Userback · Userback

Name of the Vulnerable Software and Affected Versions: Userback plugin versions 1.0.13 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

GHSA-2RCP-JVR4-R259 Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables

Impact This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri...

PT-2023-29851 · Reconftw · Reconftw

Name of the Vulnerable Software and Affected Versions: reconFTW versions prior to 2.7.1.1 Description: A vulnerability has been identified in reconFTW where inadequate validation of retrieved subdomains may lead to a Remote Code Execution RCE attack. An attacker can exploit this vulnerability by...

CVE-2023-45826 Authenticated SQL Injection in leantime

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

ydb-go-sdk token in custom credentials object can leak through logs

Impact Since ydb-go-sdk/v3.48.6 if you use a custom credentials object implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using fmt.Errorf"something went wrong credentials: %q", credentials during connection to...

PT-2023-29711 · Unknown · Artifact Hub

Name of the Vulnerable Software and Affected Versions: Artifact Hub versions prior to 1.16.0 Description: Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. It includes a fine-grained authorization mechanism that...

PT-2023-29538 · Prestashop · Creative Popup

Name of the Vulnerable Software and Affected Versions: Creative Popup versions up to 1.6.9 Description: A SQL injection issue exists in the Creative Popup module for PrestaShop, allowing a guest to perform SQL injection via the cp download popup function. Recommendations: For versions up to 1.6.9...

PT-2023-6361 · Connectize · Connectize Ac21000 G6

Name of the Vulnerable Software and Affected Versions: Connectize AC21000 G6 version 641.139.1.1256 Description: The issue is related to a Cross Site Scripting XSS vulnerability that allows attackers to run arbitrary code via a crafted string when setting the Wi-Fi password in the admin panel. Th...

Security advisory: Loading invalid QML image source impacts Qt

An issue when loading an invalid QML image source has been reported and has been assigned the CVE id CVE-2023-45872. When an invalid source is used to indicate an image to be loaded is specified then it will end up trying to load it as a SVG file which will trigger a crash in Qt SVG. This does no...

AZL-31653 CVE-2023-45145 affecting package redis for versions less than 6.2.14-1

Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, another process...

CVE-2023-45813 Inefficient Regular Expression Complexity in TorBot

Torbot is an open source tor network intelligence tool. In affected versions the torbot.modules.validators.validatelink function uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash...

CVE-2023-45145 Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.

Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, another process...

Improper restriction of XML external entity references (XXE) in Proself

Overview Proself provided by North Grid Corporation improperly restricts XML external entity references XXE CWE-611. The developer states that attacks exploiting this vulnerability have been observed. North Grid Corporation reported this vulnerability to JPCERT/CC to notify users of its solution...

PT-2023-32952

Name of the Vulnerable Software and Affected Versions Rustix versions prior to 0.35.15 Rustix versions prior to 0.36.16 Rustix versions prior to 0.37.25 Rustix versions prior to 0.38.19 Description The issue arises when using rustix::fs::Dir with the linux raw backend, where the iterator can get...

PT-2023-29765 · Wipotec Gmbh · Comscale

Name of the Vulnerable Software and Affected Versions: WIPOTEC GmbH ComScale versions 4.3.29.21344 through 4.4.12.723 Description: The issue allows unauthenticated attackers to read files from the underlying operating system and obtain directory listings due to a failure in validating user...

PT-2023-31977 · WordPress · Chatbot

Name of the Vulnerable Software and Affected Versions: ChatBot plugin for WordPress versions up to, and including, 4.8.9 Description: The issue allows unauthenticated attackers to extract sensitive data, including confirmation of whether a user name exists on the site and order information for...

JVN#95981460: Improper restriction of XML external entity references (XXE) in Proself

Proself provided by North Grid Corporation improperly restricts XML external entity references XXE CWE-611. The developer states that attacks exploiting this vulnerability have been observed. Impact By processing a specially crafted request containing malformed XML data, arbitrary files on the...

Plonk verifier KZG multi point verification

Impact The vulnerability allows a third party to derive a valid proof from a valid initial tuple proof, publicinputs, corresponding to the same public inputs as the initial proof. It is due to a randomness being generated using a small part of the scratch memory describing the state, allowing for...

github.com/kumahq/kuma affected by CVE-2023-44487

Impact Envoy and Go HTTP/2 protocol stack is vulnerable to the "Rapid Reset" class of exploits, which send a sequence of HEADERS frames optionally followed by RSTSTREAM frames. This can be exercised if you use the builtin gateway and receive untrusted http2 traffic. Patches...