Muhammad Daffa

اسم البرنامج المعرض للخطر والإصدارات المتأثرة إصدارات OpenSSL من 3.0 إلى 3.6 الوصف قد تؤدي معالجة رسالة CMS EnvelopedData مصممة خصيصًا باستخدام KeyAgreeRecipientInfo إلى إزالة مرجعية مؤشر NULL. وقد يتسبب ذلك في تعطل التطبيقات التي تعالج بيانات CMS التي يتحكم فيها المهاجم قبل عمليات المصادقة أو التشفير، مما يؤدي إلى حدوث هجوم رفض الخدمة (DoS). تحدث هذه المشكلة عند فحص حقل المعلمات الاختيارية لـ KeyEncryptionAlgorithmIdentifier دون التحقق من وجوده، مما يؤدي إلى إزالة مرجعية مؤشر NULL في حالة عدم وجود الحقل. تتأثر التطبيقات والخدمات التي تستدعي الدالة CMS decrypt() على مدخلات غير موثوق بها، مثل معالجة S/MIME أو البروتوكولات القائمة على CMS. التوصيات قم بالتحديث إلى إصدار أحدث من 3.6. كحل مؤقت، تجنب معالجة رسائل CMS EnvelopedData غير الموثوق بها التي تحتوي على KeyAgreeRecipientInfo.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة إصدارات OpenSSL من 3.0 إلى 3.6 الوصف قد تؤدي معالجة رسالة CMS EnvelopedData مصممة خصيصًا تحتوي على KeyTransportRecipientInfo إلى إزالة مرجعية مؤشر NULL. وقد يتسبب ذلك في تعطل التطبيقات التي تعالج بيانات CMS التي يسيطر عليها المهاجم قبل عمليات المصادقة أو التشفير، مما يؤدي إلى حدوث هجوم «رفض الخدمة» (DoS). تحدث المشكلة عند فحص حقل المعلمات الاختيارية لمعرف خوارزمية RSA-OAEP SourceFunc دون التحقق من وجوده، مما يؤدي إلى إزالة مرجعية مؤشر NULL في حالة عدم وجود الحقل. تتأثر التطبيقات والخدمات التي تستخدم CMS decrypt() على مدخلات غير موثوق بها، مثل معالجة S/MIME أو البروتوكولات القائمة على CMS. التوصيات التحديث إلى إصدار أحدث من 3.6. قم بالتحديث إلى إصدار أحدث من 3.5. قم بالتحديث إلى إصدار أحدث من 3.4. قم بالتحديث إلى إصدار أحدث من 3.3. قم بالتحديث إلى إصدار أحدث من 3.0.

The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This can lead to a CSRF vulnerability, enabling unauthorized settings reset.

Name of the Vulnerable Software and Affected Versions: Pinpoint Booking System versions through 2.9.9.5.2 Description: The issue is related to a Missing Authorization vulnerability in the Pinpoint Booking System, allowing exploitation of incorrectly configured access control security levels. Recommendations: For versions through 2.9.9.5.2, update to a version that addresses the Missing Authorization vulnerability to prevent exploitation of access control security levels. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthenticated settings changes, potentially leading to exploitation. The vulnerability affects the Woo Multi Currency plugin for WordPress.

The issue is related to a Missing Authorization vulnerability in the Enhanced Text Widget, which allows exploiting incorrectly configured access control security levels.

The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels.

The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This can lead to unauthorized access and potentially other security issues. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and also store malicious scripts that can be executed by other users.

The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows Code Injection. This means an attacker can trick a user into performing unintended actions on a web application, potentially leading to the execution of malicious code.

The issue is a Server-Side Request Forgery (SSRF) vulnerability. This means that an attacker could potentially force the server to make unintended requests, leading to various security issues.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Reflected XSS.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS, where an attacker can inject malicious scripts into a website, potentially affecting users who visit the compromised page. The vulnerability is present in the Portfoliohub WordPress Portfolio Builder – Portfolio Gallery plugin.

The issue is a Cross-Site Request Forgery (CSRF) vulnerability that also allows Stored XSS in the Pinpoint Booking System.

The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS) or Stored XSS. This allows Stored XSS attacks, which can be executed by an attacker.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability that also allows Cross-Site Scripting (XSS).

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS.

Name of the Vulnerable Software and Affected Versions: Event Management Tickets Booking versions 1.4.0 and earlier Description: The issue is related to the exposure of sensitive information to unauthorized actors. This is a problem where sensitive data is made available to individuals who should not have access to it. Recommendations: For versions 1.4.0 and earlier, update to a version that contains a fix for this issue, as the current version exposes sensitive information to unauthorized actors. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the exposure of sensitive information to an unauthorized actor. This could potentially lead to the leak of sensitive information.