Cisco IOS XR Software for ASR 9000 Series Routers Bidirectional Forwarding Detection Denial of Service Vulnerability

A vulnerability in the bidirectional forwarding detection BFD hardware offload feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Performance Routers, and ASR 9903 Compact High-Performance Routers could allow an unauthenticated, remote...

Denial of Service (DoS)

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

CVE-2023-27476

OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service interface standards, and their related content models. OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution, and could lead to arbitrary file reads from an...

PT-2023-21405 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.393 and earlier Jenkins LTS versions 2.375.3 and earlier Description: The issue arises when Jenkins creates a temporary file in the default temporary directory with default permissions for newly created files during plugin...

PT-2023-2035

Name of the Vulnerable Software and Affected Versions Rack versions prior to 3.0.4.2 Rack versions prior to 2.2.6.3 Rack versions prior to 2.1.4.3 Rack versions prior to 2.0.9.3 Description A DoS issue exists in the Multipart MIME parsing code, allowing an attacker to craft requests that can be...

PT-2023-2258 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.270 through 2.393 Jenkins LTS versions 2.277.1 through 2.375.3 Description: The issue is related to errors in handling HTTP headers, which can allow a remote attacker to perform cross-site scripting XSS attacks. The...

CVE-2023-27476 XML External Entity (XXE) Injection in OWSLib

OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service interface standards, and their related content models. OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution, and could lead to arbitrary file reads from an...

CVE-2023-27478

libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. libmemcached could return data for a previously requested key, if that previous request timed out due to a low POLLTIMEOUT. This issue has been addressed in version 1.1.4. Users are advised to upgrade...

CVE-2023-27478

libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. libmemcached could return data for a previously requested key, if that previous request timed out due to a low POLLTIMEOUT. This issue has been addressed in version 1.1.4. Users are advised to upgrade...

Design/Logic Flaw

libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. libmemcached could return data for a previously requested key, if that previous request timed out due to a low POLLTIMEOUT. This issue has been addressed in version 1.1.4. Users are advised to upgrade...

CVE-2023-27478

The CVE-2023-27478 issue affects the libmemcached-awesome library (C/C++ client for memcached). Affected behavior: libmemcached could return data for a previously requested key when a prior request timed out due to a low POLL_TIMEOUT. Root cause is limited to that timing condition; the advisory n...

PT-2023-21153 · Xml.Etree +2 · Xml.Etree +2

Name of the Vulnerable Software and Affected Versions: OWSLib versions prior to 0.28.1 Description: The XML parser in OWSLib does not disable entity resolution, which could lead to arbitrary file reads from an attacker-controlled XML payload. This issue affects all XML parsing in the codebase. Th...

PT-2023-21161 · Unknown · Thmmniii/Fbs-Core

Name of the Vulnerable Software and Affected Versions: thmmniii/fbs-core versions prior to 1.5.3 Description: thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3, when querying subresults, it is possible to query subresults from other users due to...

PT-2023-13545 · Mia-Med · Mia-Med

Name of the Vulnerable Software and Affected Versions: Mia-Med versions prior to 1.0.0.58 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecting malicious SQ...

Buffer overflow

A buffer underwrite 'buffer underflow' vulnerability in FortiOS, FortiManager, FortiAnalyzer, FortiWeb, FortiProxy & FortiSwitchManager administrative interface may allow a remote unauthenticated attacker to execute arbitrary code on the device and/or perform a DoS on the GUI, via specifically...

PT-2023-19994 · Crmeb · Crmeb

Name of the Vulnerable Software and Affected Versions: CRMEB versions 1.3.4 and earlier Description: The issue is related to SQL Injection, which can be exploited via the "/api/admin/user/list" API endpoint. Recommendations: For CRMEB versions 1.3.4 and earlier, as a temporary workaround, conside...

Design/Logic Flaw

The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches and possibly other branches a logic inversion sneaked...

CVE-2023-27474 HTML Injection in Password Reset email to custom Reset URL in directus

Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL. An attacker could exploit this to email users urls to the servers domain...

PT-2023-20493 · Dot-Lens · Dot-Lens

Name of the Vulnerable Software and Affected Versions: dot-lens versions all Description: The issue concerns Prototype Pollution via the set function in the index.js file. This affects all versions of the dot-lens package. There is no information provided about the estimated number of potentially...

PT-2023-20690 · Ghost · Ghost

Name of the Vulnerable Software and Affected Versions: Ghost version 5.35.0 Description: The issue allows contributors to view draft posts of other users, which may be inconsistent with a security policy where a contributor's draft should only be readable by editors until published. The vendor do...