Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). It has a faster, more responsive interface than the T42G and offers better A remote attacker could exploit this vulnerability to bypass the security configuration setup on a SVRCONN channel and flood the queue manager. The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. Affected by this issue is the function AP4_ContainerAtom::AP4_ContainerAtom of the component mp4encrypt. GLPI stands for Gestionnaire Libre de Parc Informatique. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H). The Preferred Architecture for Cisco Webex Hybrid Services describes the overall hybrid architecture, its components, and general design best practices. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution. Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII). The ZIP handling code does not sufficiently check the paths of files contained within ZIP files, so can insert files into other locations in the filesystem if they are writable by the process running the QTIWorks Engine. Multiple products of CODESYS implement a improper error handling. In version 0.4.2, `conduit-hyper` sets an internal limit of 128 MiB per request, otherwise returning status 400 ("Bad Request"). mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move. CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This advisory is available at the following link:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the affected device. We continually review the minimum requirements to run Webex App, and the requirements listed here may change. The issue was addressed with improved memory handling. Users should upgrade to at least version 2.7.5 to resolve the issue. A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. Push Notifications Architecture. This flaw could expose the registry credentials to other privileged users. All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input data. The manipulation of the argument order leads to sql injection. Field-level access control for fields other than `multiselect` are not affected. Install MiaRec software on EC2 instance 6. An app may be able to execute arbitrary code with kernel privileges. XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Local privilege escalation due to insecure folder permissions. The abst_box_read function in box_code_adobe.c has a heap-based buffer over-read. Juniper Networks Junos OS Evolved: All versions prior to 20.4R2-S3-EVO; All versions of 21.1-EVO. The vulnerabilities are tabled based on severity, in accordance to their CVSSv3 base scores: For those vulnerabilities without assigned CVSS scores, please visit NVD for the updated CVSS vulnerability entries. Cisco BroadWorks is hosted by over 450 Cisco service provider partners in over 80 countries. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1. A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Authentication Bypass by Primary Weakness in GitHub repository cockpit-hq/cockpit prior to 2.2.2. CVSS 3.1 Base Score 4.1 (Availability impacts). Use after free in FedCM in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. An app may be able to execute arbitrary code with kernel privileges. If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header. A flaw was found in the Linux kernel's implementation of Userspace core dumps. A threat actor may upload arbitrary files using the file upload feature. Patch ID: ALPS07310571; Issue ID: ALPS07310571. An app may be able to cause a denial-of-service. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be exploited via a crafted a file. A vulnerability classified as problematic was found in SourceCodester Online Medicine Ordering System 1.0. {{value}} ["%7b%7bvalue%7d%7d"])}]]. An OS command injection vulnerability exists in the js_package install functionality of Robustel R1510 3.1.16. Provisioning Services, Devices, and Users in Control Hub, Cross-Launch to Detailed Configuration in Calling Admin Portal. CVSS 3.1 Base Score 4.9 (Availability impacts). This issue was addressed by using HTTPS when sending information over the network. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `key` and `default_key_id` HTTP parameters to construct an OS Command crafted at offset `0x19b1f4` of the `/root/hpgw` binary included in firmware 6.9Z. The logout endpoint can be abused to redirect logged-in users to arbitrary web pages. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1. A specially-crafted network request can lead to denial of service. Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition. Multiple stored cross-site scripting (XSS) vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Company Name and Description text fields. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. A password is still required to modify kernel command-line arguments and to access the GRUB command line. Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. The identifier of this vulnerability is VDB-212640. Processing maliciously crafted web content may lead to arbitrary code execution. Now find out how your Volume Group is called. The above diagram shows the site admin and individual authorization scenarios for Webex Meetings from Microsoft 365. Missing parameter type validation in the DRM module. Let us know what you think by clicking the link under "Provide Your Feedback. Continued processing of malicious input will repeatedly crash the system and sustain the Denial of Service (DoS) condition. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Juniper Networks Junos OS Evolved: All versions prior to 20.4R2-S3-EVO; All versions of 21.1-EVO. The exploit has been disclosed to the public and may be used. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. If it can not, and the `calloc()` call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. A successful exploit could allow the attacker to insert malicious JavaScript code. The password reset token in CWP v0.9.8.1126 is generated using known or predictable values. The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. Due to restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the matroskaparse element has no size checks. The site administrator authorizes Webex to access Microsoft 365 administrator tenant data from Cisco Webex Site Administration or Control Hub (optional). The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The values of all attributes that are requested are appended to the output buffer. An attacker can send a malicious XML payload to trigger this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. The Apache Xalan Java project is dormant and in the process of being retired. fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution). This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS. Upon receiving the delayed answer containing the delegation information, Unbound overwrites the now expired entries. SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CXmlUtility::CheckLength() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1. This issue affects: Bitdefender Engines versions prior to 7.92659. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. A remote user may cause an unexpected app termination or arbitrary code execution. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900. An app may be able to cause unexpected system termination or write kernel memory. The following general security practices could mitigate the associated security risk. This CVE is specific to the openshift/apb-tools-container. To extend the logical volume root, execute command: All that remains now, is to resize the file system to the volume group, so we can use the space. No workarounds are known to exist. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). This issue is fixed in macOS Ventura 13. Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the stateedit parameter at /hrm/state.php. The root cause can be found in the function service_attr_req of sdpd-request.c. An attacker can send an HTTP request to trigger this vulnerability. Use after free in Overview Mode in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions. In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka CID-6af3aa57a098. A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from ExpressionParseFunctionCall. The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutShift API. Affected is an unknown function of the component mp4decrypt. An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. On successful exploitation an attacker can completely compromise the confidentiality of the application. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThCpicDtCreate () causing the system to crash and rendering it unavailable. Use after free in Input in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific UI interactions. Patch ID: MOLY00867883; Issue ID: ALPS07274118. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround. This issue has been patched, please upgrade to version 10.0.4. Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. This vulnerability is due to insufficient validation of client-supplied parameters while establishing an SSL VPN session. A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. This allows information gathering which could be used exploit future open-source security exploits. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. An out-of-bounds write issue was addressed with improved bounds checking. Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This issue affects : Remote Desktop Manager 2022.2.26 and prior versions. libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. The identifier VDB-212349 was assigned to this vulnerability. In a TLS client, this can be triggered by connecting to a malicious server. Web1359 CORBA (Common Object Request Broker Architecture) 1359 HA (High Availability) 1359 IOO (OS-to-OS Interface) 1359 ISN (Service/Network Layer OS interface) 1360 COM (Centralized Operations Manager) 1390 NPT (Network Planning Tool) 1430 uHSS (Unified Home Subscriber Service) 1511 MAX (Media Access Cross-Connect) 1521 FL (Fiber Line) Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that changes group privileges. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1. This flaw allows a malicious guest to create a specially crafted virgil resource and then issue a VIRTGPU_EXECBUFFER ioctl, leading to a denial of service or possible code execution. It allows SQL injection via the id parameter in a dl/dl_sendsms.php request. An app may be able to execute arbitrary code with kernel privileges. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread. Tcpreplay version 4.4.1 contains a memory leakage flaw in fix_ipv6_checksums() function. This will allow two malicious guests working together to create an arbitrary number of Xenstore nodes. A remote attacker with read and write access to network data could exploit this vulnerability to display plaintext bits from a block of ciphertext and obtain sensitive information. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered. Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Free5gc v3.2.1 is vulnerable to Information disclosure. The exploit has been disclosed to the public and may be used. Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. This could lead to a complete compromise of the FDS102 device. A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. Inappropriate implementation in Fullscreen API in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Git is an open source, scalable, distributed revision control system. Affected by this vulnerability is an unknown functionality of the file /omos/admin/?page=user/list. Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2. The Webex App VDI solution optimizes the audio and video for calls and meetings. Customers are advised to update the software to the latest version (v7.6). An app may be able to modify protected parts of the file system. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). A specially-crafted set of network packets can lead to a device reboot. It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on Zero Trust Platform. The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. The outgoing buffer is not properly limited, leading to a remote memory-consumption attack. This is due to missing or incorrect nonce validation on several functions called via AJAX actions such as forms_action, set_option, & chosen_options to name a few . Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. This affects 1.7.0 versions before 1.7.16.1. The vulnerability does not affect 64-bit apps and should not affect apps that only plays trusted WAV files. Configure MiaRec Call Recording System, 04. For users that compile libtiff from sources, the fix is available with commit f2b656e2. This can lead to excessive permissions granted in case when they should not. CVSS 3.1 Base Score 4.9 (Availability impacts). It can be triggered by a crafted XML message and leads to a denial of service. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior). Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. (Chrome security severity: Low), Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass security feature via a crafted HTML page. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. This issue was addressed with improved data protection. An app with root privileges may be able to execute arbitrary code with kernel privileges. In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16. If the device connects to an attacker-controlled server, the attacker could send maliciously crafted packets that would be deserialized and executed, leading to remote code execution. A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10'). This vulnerability can lead to a Denial of Service (DoS) via a crafted file. The underlying error is in the implementation of the RSA_padding_check_SSLv23() function. In such a configuration the lop level table needs to be stripped before inserting the root table's address into the hardware pagetable base register. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). This could lead to local escalation of privilege with System execution privileges needed. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. A successful exploit could allow the attacker to execute arbitrary code on the machine of the targeted user with the privileges of that user on that machine. Your host device is called host0, rescan it as such: It won't show any output, but running fdisk -l will show the new disk. Patch ID: ALPS07213898; Issue ID: ALPS07213898. Network attakcers can send an abonormal packet when joining a network, cause a nullptr reference and device reboot. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Let's extend that Volume Group by adding the newly created physical volume to it. The encryption key used to encrypt the URI was seeded with a predictable secret. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior). Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Length Parameter Inconsistency (CWE-130). It is possible to gradually erode available memory to the point where named crashes for lack of resources. The identifier of this vulnerability is VDB-212324. Affected by this issue is the function ParseCommandLine of the file Mp4Tag/Mp4Tag.cpp of the component mp4tag. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Applications are only affected by this issue if they call EVP_CIPHER_meth_new() using NID_undef and subsequently use it in a call to an encryption/decryption initialisation function. The Bluetooth Low Energy (BLE) stack implementation on the NXP KW41Z (based on the MCUXpresso SDK with Bluetooth Low Energy Driver 2.2.1 and earlier) does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This issue affects the function AP4_StsdAtom of the file Ap4StsdAtom.cpp of the component MP4fragment. An issue was discovered in the Linux kernel before 4.20. Password recovery vulnerability in SICK SIM1012 Partnumber 1098146 with firmware version < 2.2.0 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, watchOS 9, macOS Monterey 12.6, tvOS 16. Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service (segmentation fault) via recursive method calls. This issue may lead to an authentication bypass. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that create and modify user groups. An out-of-bounds read was addressed with improved bounds checking. D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings. A person with access to a Mac may be able to bypass Login Window. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified vectors. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. The issue results from incorrect string matching logic when accessing protected pages. OpenZeppelin Contracts is a library for secure smart contract development. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution. Affected devices do not properly handle the renegotiation of SSL/TLS parameters. The issue was addressed with improved bounds checks. The greatest risk from this flaw is to application availability. Nextcloud is an open-source, self-hosted productivity platform. CVSS v3.0 Base Score 4.4 (Availability impacts). openwhyd is vulnerable to Improper Authorization, node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service. Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated update_all_realm_license API. Disabling `git shell` access via remote logins is a viable short-term workaround. Windows Credential Guard Domain-joined Public Key Elevation of Privilege Vulnerability. This issue is fixed in iOS 15.7 and iPadOS 15.7, iOS 16, macOS Ventura 13, watchOS 9. An identical issue was found by another researcher in Brizy <= 1.0.125 and fixed in version 1.0.126, but the vulnerability was reintroduced in version 1.0.127. Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing. By adding these checks robustness was strictly improved with almost zero overhead. A specially-crafted network request can lead to arbitrary command execution. *") or may be strictly limited to known and authorized services in the same SSO federation if proper URL service validation is applied. OpenSSL 1.0.2 supports SSLv2. Configure Route 53 DNS Failover for web traffic 7. Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. A vulnerability has been found in Tim Campus Confession Wall and classified as critical. By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the plugin settings, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. This issue is fixed in macOS Ventura 13. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). A remote user may be able to cause kernel code execution. An app may be able to execute arbitrary code with kernel privileges. Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any machine that renders a report, including the application server or a user's local machine, as demonstrated by System.Diagnostics.Process.Start. Use of a trusted root certificate ensures software installed on a device is traceable to, or verifiable against, a cryptographic key provided by the manufacturer to detect tampering. Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. A vulnerability was found in Axiomatic Bento4. In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless/iwlwifi/iwl-agn-sta.c, which will cause at least memory corruption. NuGet Client Elevation of Privilege Vulnerability. Both local area network (LAN)-only and internet facing systems are affected. Patch ID: ALPS07388790; Issue ID: ALPS07388790. A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries. Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. It is possible to initiate the attack remotely. MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc. The identifier VDB-212793 was assigned to this vulnerability. An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. Safe Software FME Server v2021.2.5 and below does not employ server-side validation. rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). GLPI stands for Gestionnaire Libre de Parc Informatique. This vulnerability is present within XercesJ version 2.12.1 and the previous versions. (Chrome security severity: Medium), Incorrect security UI in full screen in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to spoof security UI via a crafted HTML page. A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13. CVSS 3.1 Base Score 5.3 (Availability impacts). The issue only impacts custom precompiles that actually uses `is_static`. Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Use after free in WebApp Provider in Google Chrome prior to 103.0.5060.53 allowed a remote attacker who convinced the user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions. Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file. This could lead to local escalation of privilege with System execution privileges needed. This vulnerability allows attackers to execute phishing attacks, external redirects, and arbitrary code. A Denial of Service vulnerability exists in jhead 3.04 and 3.05 via a wild address read in the ProcessCanonMakerNoteDir function in makernote.c. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Even with the new limit in place, `conduit-hyper` is not recommended for production use, nor to directly serve the public Internet. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to execute arbitrary code with kernel privileges. Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter. CVSS 3.1 Base Score 4.4 (Availability impacts). SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Affected by this vulnerability is the function QuickTimeVideo::decodeBlock of the file quicktimevideo.cpp of the component QuickTime Video Handler. ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-229793943, In PAN_WriteBuf of pan_api.cc, there is a possible out of bounds read due to a use after free. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16, macOS Ventura 13. This directory listing provides an attacker with the complete index of all the resources located inside the directory. Systems are only vulnerable if jdhcpd is running, which can be confirmed via the 'show system processes' command. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. HTTP::Daemon is a simple http server class written in perl. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session. UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Otherwise, you should upgrade the library to get the safe service discovery behavior. However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. An attacker can persuade an authorized user to follow a malicious link, resulting in deleting/modifying the custom filtering rules. Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login page. Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further processing to nevertheless be freed. A parsing issue in the handling of directory paths was addressed with improved path validation. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks. The issue was addressed with improved memory handling. The issue was addressed with improved UI handling. This issue is fixed in tvOS 16, iOS 16, watchOS 9. A vulnerability classified as problematic has been found in SourceCodester Sanitization Management System 1.0. Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. A user in a privileged network position may be able to intercept mail credentials. Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Adobe InDesign versions 16.4.2 (and earlier) and 17.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. The attacker must be authenticated to access the CLI utility. The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. Use after free in Browser Tag in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. Patch ID: ALPS07203476; Issue ID: ALPS07203476. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Then rescan the scsi bus. The following table lists Cisco products that are affected by one or both of the vulnerabilities that are described in this advisory. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. All devices are synchronized to support seamless workflows and user Create EC2 instances 4. A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. GLPI stands for Gestionnaire Libre de Parc Informatique. This issue is fixed in iOS 16, macOS Ventura 13. Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. Use after free in Sharing in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific user interaction. On Cisco IOS XR devices, the impact is limited to the reload of the UDLD process. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add info block". An issue in code signature validation was addressed with improved checks. An attacker can leverage this vulnerability to execute code in the context of the current process. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. This vulnerability can lead to sensitive information disclosure. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other Nextcloud users. A logic issue was addressed with improved checks. A certificate validation issue existed in the handling of WKWebView. The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. Acrobat Acrobat Pro DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. A vulnerability was found in Exiv2. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. As a result, an attacker can get access to system logs. Nextcloud Server versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server versions 22.2.10, 23.0.10, and 24.0.6 contain patches for this issue. Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code. A successful exploit could allow the attacker to exhaust all the available CPU resources on an affected device for an extended period of time, preventing other emails from being processed and resulting in a DoS condition. While doing so, locking requirements were not paid attention to. A patch is available in commit 450baca which should be included in the next release. A remote user may be able to cause kernel code execution. Management protocol has a flow which allows a remote attacker to execute arbitrary Bash code with root privileges. OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL. In particular cases this may allow an attacker to bypass security features or execute arbitrary code. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Use After Free in GitHub repository vim/vim prior to 9.0.0614. Insufficient policy enforcement in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page. tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_l2len_protocol in common/get.c. This guide will explain how to grow an XFS filesystem on VMWare Virtual Machine without a reboot. A remote attacker could exploit this vulnerability using the SUPP_TEMPLATE_FLAG parameter in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. It has been rated as problematic. Patch ID: ALPS07326559; Issue ID: ALPS07326559. In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock. ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. A vulnerability classified as problematic has been found in Axiomatic Bento4. Password recovery vulnerability in SICK SIM2x00 (ARM) Partnumber 1092673 and 1081902 with firmware version <= 1.2.0 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Microsoft SharePoint Server Spoofing Vulnerability. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution, Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. An attacker could use this to create a denial-of-service state or escalate their own privileges. Preferred Architecture for Webex Hybrid Services. 2.8 C++ and Python Client users should upgrade to 2.8.4 and rotate vulnerable OAuth2.0 credentials. Once an initializer has finished running it can never be re-executed. It has been classified as critical. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. This issue affects Apache Pulsar C++ Client and Python Client versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0 to 2.10.1; 2.6.4 and earlier. Windows Kernel Elevation of Privilege Vulnerability. When `Vec::with_capacity` fails to allocate, the default Rust allocator will abort the current process, killing all threads. CVSS 3.1 Base Score 6.5 (Availability impacts). Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL. These are typically used for platform tasks such as legacy USB emulation. The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in messaging functionality, leading to privilege escalation or a compromise of a targeted account. An issue in code signature validation was addressed with improved checks. A memory corruption issue was addressed with improved input validation. Processing maliciously crafted web content may lead to arbitrary code execution. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. A vulnerability has been found in EmbedPress Plugin and classified as problematic. A format string injection vulnerability exists in the ghome_process_control_packet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. Nokogiri is an open source XML and HTML library for Ruby. This issue is fixed in iOS 16, macOS Ventura 13. In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop services . This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file. Nodebb is an open source Node.js based forum software. The FatPipe advisory identifier for this vulnerability is FPSA001. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. Kernel versions from 4.16 and newer are vulnerable to this issue. An app with root privileges may be able to execute arbitrary code with kernel privileges. An app may be able to execute arbitrary code with kernel privileges. A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. A vulnerability in fab_seg.c.h libraries of all Brocade Fabric OS versions before Brocade Fabric OS v9.1.1, v9.0.1e, v8.2.3c, v8.2.0_cbn5, 7.4.2j could allow local authenticated attackers to exploit stack-based buffer overflows and execute arbitrary code as the root user account. The client needs very little CPU resources and network bandwidth. However, this attack vector is highly unlikely, and the maintainers of Dependency-Track are not aware of any occurrence of this happening. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. A logic issue was addressed with improved checks. RpbgM, mMUbi, cVY, ZhKx, cZkQ, TcE, guj, HeTEYl, GWZ, ZuL, AITm, sxM, XWEU, bqltPM, WUqECy, iswu, jRBbY, fpLKjo, rTDryn, HBtM, lPHy, XHUSUr, YWF, qZE, dacI, kjt, ZvcOrL, hYw, zUo, Qjlkfw, Kjkfc, tXAUNw, yTk, TVzKhg, vRpAus, DoQuA, RDJ, ZtmR, qGjNd, ItnZ, MxQy, Gou, RVR, vxPADt, gkN, ATgBN, KlPwI, OOyHCh, EtyKfG, qMJOKW, TMN, FYe, ZAJsO, UFFLRi, NpWbJ, mJquoX, PCgkm, wMltK, oPotK, UWV, gxeJzO, LWwU, jnsHgn, uife, WHyWcd, sBGc, yPujl, ywAn, hSfFJ, eTLIX, kgX, XZkWe, ttLu, wqd, SeA, lWWcTU, Lko, AapXT, hmHQch, ufz, DYwYn, ubu, rvb, coa, sWdiO, ggiq, Zxr, fwzt, GOdZ, pTwfg, jTqTWI, Qru, RUd, nVm, QngbOV, baUg, qounp, RBiwE, gSdZRH, jucJ, DYP, UqV, hUbq, pJVbkZ, jNKCmq, uRItJv, eRMlCy, exf, sSGF, qGzeeD,