Information Exposure

Overview activesupport is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Affected versions of this package are vulnerable to Information Exposure. The ImpactActiveSupport::EncryptedFile method writes contents that will be encrypted to a temporary file...

PT-2023-26260

Name of the Vulnerable Software and Affected Versions Active Support versions 5.2.0 through 7.0.7.0 Active Support versions 6.1.7.4 and earlier Description The issue arises from ActiveSupport::EncryptedFile writing contents to a temporary file with permissions defaulted to the user's current umas...

PT-2023-11759 · Fedora +1 · Fedora Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Fedora Linux kernel version 5.9.0-rc9 Description: A Use After Free issue allows attackers to obtain sensitive information via the vgacon invert region function. Recommendations: For Fedora Linux kernel version 5.9.0-rc9, as a temporary...

PT-2023-12167 · Dpic +1 · Dpic +1

Name of the Vulnerable Software and Affected Versions: dpic version 2021.01.01 Description: The issue is related to a Heap Use-After-Free in the deletestringbox function located in dpic.y. Recommendations: For dpic version 2021.01.01, as a temporary workaround, consider disabling the...

PT-2023-12166 · Dpic +1 · Dpic +1

Name of the Vulnerable Software and Affected Versions: dpic version 2021.01.01 Description: The issue is a Heap-based Buffer Overflow in the thestorestring function in dpic.y. This occurs due to improper handling of data, leading to a potential overflow. No information is provided about the...

PT-2023-12933 · Radare2 · Radare2

Name of the Vulnerable Software and Affected Versions: radare2 versions 5.4.0 through 5.4.2 Description: A null pointer deference issue exists in the core anal fcn function. Recommendations: For versions 5.4.0 and 5.4.2, consider disabling the core anal fcn function as a temporary workaround unti...

PT-2023-13333 · Etcd +1 · Etcd +1

Name of the Vulnerable Software and Affected Versions: Etcd version 3.5.4 Description: The issue allows remote attackers to cause a denial of service via the PageWriter.write function in pagewriter.go. The vendor's position is that this is not a vulnerability. Recommendations: For Etcd version...

Machine catalog updates failure with error the master VM as an invalid configuration

VMWARE Hypervisor When updating a particular machine catalog with a new master image, the operation fails early on with one of the following: "action name: updatemachinecatalogprovisiningscheme" "action name: MCUpdateMachineCatalog" Error : The master VM as an invalid configuration Same issue...

PT-2023-12211 · Dpic +1 · Dpic +1

Name of the Vulnerable Software and Affected Versions: dpic version 2021.04.10 Description: The issue is related to a use-after-free in the deleteStringBox function in dpic.y. Recommendations: For dpic version 2021.04.10, consider disabling the deleteStringBox function as a temporary workaround...

PT-2023-11602 · Unknown +1 · Oggvideotools +1

Name of the Vulnerable Software and Affected Versions: oggvideotools version 0.9.1 Description: A Segmentation Fault issue was discovered in the StreamSerializer::extractStreams function in streamSerializer.cpp, allowing remote attackers to cause a denial of service crash via the opening of a...

PT-2023-11670 · Freeimage +1 · Freeimage +1

Name of the Vulnerable Software and Affected Versions: FreeImage version 3.19.0 Description: The issue allows remote attackers to run arbitrary code via the use of a crafted psd file, exploiting a Buffer Overflow vulnerability in the ReadImageLine function within PSDParser.cpp. Recommendations: F...

PT-2023-19043 · Geomatika · Geomatika Isigeo Web

Name of the Vulnerable Software and Affected Versions: Geomatika IsiGeo Web version 6.0 Description: The issue allows remote authenticated users to obtain sensitive database content via SQL Injection. Recommendations: For Geomatika IsiGeo Web version 6.0, consider restricting access to sensitive...

PT-2023-15135 · Glibc +4 · Glibc +4

Name of the Vulnerable Software and Affected Versions: open-mpi hwloc version 2.1.0 Description: An issue was discovered in open-mpi hwloc that allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. Recommendations: For open-mpi hwloc...

Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.6.8 or apply this patch manually...

PT-2023-4712 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 4.1M2 through 14.10.4 XWiki Platform versions prior to 14.10.5 and 15.1RC1 Description: The issue is related to a stored XSS vulnerability that can be exploited by any registered user through their user profile by...

PT-2023-26715 · Weaviate · Weaviate

Name of the Vulnerable Software and Affected Versions: Weaviate versions 1.20.0 and earlier Description: The issue is a type conversion problem that allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function. This affects users of Weaviate Server versions...

JVN#19661362: Multiple vulnerabilities in Proself

Proself provided by North Grid Corporation is an online storage server software. Proself contains multiple vulnerabilities listed below. Improper authentication CWE-287 - CVE-2023-39415 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N| Base Score: 7.5 CVSS...

PT-2023-4468 · D Link · D-Link Dir-880L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-880 A1 FW107WWb08 Description: The issue is related to a NULL pointer dereference in the FUN 00010824 function. This can potentially allow a remote attacker to cause a denial of service. Recommendations: For D-Link DIR-880 A1...

PT-2023-26620 · Unknown · Kidus Minimati

Name of the Vulnerable Software and Affected Versions: Kidus Minimati version 1.0.0 Description: The issue allows a remote attacker to obtain sensitive information via the "edit.php" component. This is due to a SQL injection vulnerability. Recommendations: For Kidus Minimati version 1.0.0, consid...

PT-2023-4469 · D Link · D-Link Dir-880L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-880 A1 FW107WWb08 Description: The issue is related to a buffer overflow in the function FUN 0001be68 of the D-Link DIR-880 A1 router's firmware. This buffer overflow can be exploited by a remote attacker to execute arbitrary code...