🚨 CVE-2023-34089
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in version 0.27.3 and 0.26.6.
🎖@cveNotify
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in version 0.27.3 and 0.26.6.
🎖@cveNotify
GitHub
Release v0.27.3 · decidim/decidim
Security fixes
This release addresses several security issues, including the following:
CVE-2023-32693
CVE-2023-34089
CVE-2023-34090
The details regarding the security vulnerability will be publi...
This release addresses several security issues, including the following:
CVE-2023-32693
CVE-2023-34089
CVE-2023-34090
The details regarding the security vulnerability will be publi...
🚨 CVE-2023-32056
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
🎖@cveNotify
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
🎖@cveNotify
🚨 CVE-2023-32039
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
🎖@cveNotify
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
🎖@cveNotify
🚨 CVE-2023-30607
icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.
🎖@cveNotify
icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.
🎖@cveNotify
GitHub
Do not perform deletion before user input is validated in `FieldConfi… · Icinga/icingaweb2-module-jira@7f0c53b
…gForm` and `TemplateConfigForm`
This fixes susceptibility to CSRF attacks.
This fixes susceptibility to CSRF attacks.
🚨 CVE-2023-35974
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
🎖@cveNotify
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
🎖@cveNotify
🚨 CVE-2023-31248
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
🎖@cveNotify
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
🎖@cveNotify
🚨 CVE-2023-34834
A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about the configured databases via the "/file" endpoint.
🎖@cveNotify
A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about the configured databases via the "/file" endpoint.
🎖@cveNotify
Mcl-Collection
MCL-Collection V4
MCL-Collection V4 offers developers to develop Mobility Applications, cost effectively.
🚨 CVE-2023-25399
A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.
🎖@cveNotify
A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.
🎖@cveNotify
GitHub
BUG: Memory leak in function `Py_FindObjects` due to new reference is not decreased (static analyzer report) · Issue #16235 · scipy/scipy
A new reference is returned and assigned to tuple. scipy/scipy/ndimage/src/nd_image.c Line 888 in 8627df3 PyObject *tuple = PyTuple_New(PyArray_NDIM(input)); Assume tuple is not NULL. scipy/scipy/n...
🚨 CVE-2023-29406
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.
🎖@cveNotify
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.
🎖@cveNotify
🚨 CVE-2022-48521
An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely on Authentication-Results from OpenDKIM will treat the message as having a valid DKIM signature when in fact it has none.
🎖@cveNotify
An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely on Authentication-Results from OpenDKIM will treat the message as having a valid DKIM signature when in fact it has none.
🎖@cveNotify
GitHub
‘KeepAuthResults = no’ (the default setting) may delete the wrong headers · Issue #148 · trusteddomainproject/OpenDKIM
Authentication-Results headers are deleted by iterating over them in forward direction. But because each deletion shifts headers that come after it, this procedure deletes the wrong headers after t...
🚨 CVE-2022-22992
A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.
🎖@cveNotify
A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.
🎖@cveNotify
Western Digital
WDC-22002 My Cloud OS 5 Firmware 5.19.117 | WD
Western Digital delivers innovative storage solutions—HDDs, systems & personal data storage—powering innovation, reliability & future-ready performance.
🚨 CVE-2022-28127
A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary file deletion. An attacker can send a sequence of requests to trigger this vulnerability.
🎖@cveNotify
A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary file deletion. An attacker can send a sequence of requests to trigger this vulnerability.
🎖@cveNotify