PT-2023-33056 · Ibexa · Ibexa

Name of the Vulnerable Software and Affected Versions: ibexa affected versions not specified Description: The issue concerns user settings, including preferred time zone and number of items per page, which could be accessed by anonymous users. This impacts only the anonymous users themselves and...

kernel: hwmon: Handle failure to register sensor with thermal zone correctly

In the Linux kernel, the following vulnerability has been resolved: hwmon: Handle failure to register sensor with thermal zone correctly If an attempt is made to a sensor with a thermal zone and it fails, the call to devmthermalzoneofsensorregister may return -ENODEV. This may result in crashes...

PT-2023-5685 · Unknown · Control Web Panel

Name of the Vulnerable Software and Affected Versions: Control Web Panel affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. The specific flaw exists within the dns zone editor module, resulting...

rubygem-tzinfo: arbitrary code execution

A flaw was found in rubygem-tzinfo. When using the Timezone.get function, it fails to validate time zone identifiers correctly, allowing a new line character input within the identifier. This flaw allows an attacker to use the new line character and write any code, which will be executed within t...

Amazon Linux 2 : ldns (ALAS-2023-2032)

The version of ldns installed on the remote host is prior to 1.6.16-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2032 advisory. When ldns version 1.7.1 verifies a zone file, the ldnsrrnewfrmstrinternal function has a heap out of bounds read vulnerability. An...

caribbeangamezone.com Cross Site Scripting vulnerability OBB-3282546

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-2392

A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. Affected is an unknown function of the file scgi-bin/platform.cgi?page=timezone.htm of the component Web Management Interface. The manipulation of the argument ManualDate.minutes leads to cross site...

CVE-2023-2391

A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. This issue affects some unknown processing of the file scgi-bin/platform.cgi?page=timezone.htm of the component Web Management Interface. The manipulation of the argument ntp.server2 leads to cross site...

CVE-2023-2390

A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. This vulnerability affects unknown code of the file scgi-bin/platform.cgi?page=timezone.htm of the component Web Management Interface. The manipulation of the argument ntp.server1 leads to cross site...

CVE-2023-26059

An issue was discovered in Nokia NetAct before 22 SP1037. On the Site Configuration Tool tab, attackers can upload a ZIP file which, when processed, exploits Stored XSS. The upload option of the Site Configuration tool does not validate the file contents. The application is in a demilitarised zon...

Cross site scripting

An issue was discovered in Nokia NetAct before 22 SP1037. On the Site Configuration Tool tab, attackers can upload a ZIP file which, when processed, exploits Stored XSS. The upload option of the Site Configuration tool does not validate the file contents. The application is in a demilitarised zon...

CVE-2023-26059

An issue was discovered in Nokia NetAct before 22 SP1037. On the Site Configuration Tool tab, attackers can upload a ZIP file which, when processed, exploits Stored XSS. The upload option of the Site Configuration tool does not validate the file contents. The application is in a demilitarised zon...

Gaining an Advantage in Roulette

You can beat the game without a computer: On a perfect roulette wheel, the ball would always fall in a random way. But over time, wheels develop flaws, which turn into patterns. A wheel thats even marginally tilted could develop what Barnett called a drop zone. When the tilt forces the ball to...

PT-2023-2602 · NetGear · Netgear Srx5308

Name of the Vulnerable Software and Affected Versions: Netgear SRX5308 versions up to 4.3.5-3 Description: A vulnerability has been found in the Web Management Interface of Netgear SRX5308, affecting unknown code of the file scgi-bin/platform.cgi?page=time zone.htm. The manipulation of the...

PT-2023-2601 · NetGear · Netgear Srx5308

Name of the Vulnerable Software and Affected Versions: Netgear SRX5308 versions up to 4.3.5-3 Description: The issue exists due to insufficient input validation in the web management interface of the Netgear SRX5308 router's embedded software. Exploitation of this issue may allow a remote attacke...

PT-2023-2600 · NetGear · Netgear Srx5308

Name of the Vulnerable Software and Affected Versions: Netgear SRX5308 versions up to 4.3.5-3 Description: A vulnerability exists in the Web Management Interface of the Netgear SRX5308, allowing for cross-site scripting attacks. This is due to the lack of protection measures for the web page...

SUSE-SU-2023:1792-1 Security update for go1.19

This update for go1.19 fixes the following issues: Update to 1.19.8 CVE-2023-24534: security: net/http, net/textproto: denial of service from excessive memory allocation bsc1210127 CVE-2023-24536: security: net/http, net/textproto, mime/multipart: denial of service from excessive resource...

SUSE-SU-2023:1791-1 Security update for go1.20

This update for go1.20 fixes the following issues: Update to version 1.20.3: CVE-2023-24534: security: net/http, net/textproto: denial of service from excessive memory allocation bsc1210127 CVE-2023-24536: security: net/http, net/textproto, mime/multipart: denial of service from excessive resourc...

Medium: curl

Issue Overview: A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials set for this transfer. This issue leads to an authentication bypass, either by mistake or...

Using Service Control Policies to protect security baselines

Service Control Policies SCPs can be a great way to prevent actions from happening in AWS accounts. In this post, we will illustrate a specific use case of SCPs that protects the security baseline, or landing zone, configuration you’ve created for accounts...