Muhammad Daffa

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.0 through 3.6 Description Processing a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo can lead to a NULL pointer dereference. This can cause applications that process attacker-controlled CMS data to crash before authentication or cryptographic operations, resulting in a Denial of Service. The issue occurs when the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence, leading to a NULL pointer dereference if the field is missing. Applications and services calling CMS decrypt() on untrusted input, such as S/MIME processing or CMS-based protocols, are affected. Recommendations Update to a version after 3.6. As a temporary workaround, avoid processing untrusted CMS EnvelopedData messages with KeyAgreeRecipientInfo.

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.0 through 3.6 Description Processing a specially crafted CMS EnvelopedData message with KeyTransportRecipientInfo can lead to a NULL pointer dereference. This can cause applications that process attacker-controlled CMS data to crash before authentication or cryptographic operations, resulting in a Denial of Service. The issue occurs when examining the optional parameters field of RSA-OAEP SourceFunc algorithm identifier without verifying its presence, leading to a NULL pointer dereference if the field is missing. Applications and services using CMS decrypt() on untrusted input, such as S/MIME processing or CMS-based protocols, are affected. Recommendations Update to a version after 3.6. Update to a version after 3.5. Update to a version after 3.4. Update to a version after 3.3. Update to a version after 3.0.

The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This can lead to a CSRF vulnerability, enabling unauthorized settings reset.

Name of the Vulnerable Software and Affected Versions: Pinpoint Booking System versions through 2.9.9.5.2 Description: The issue is related to a Missing Authorization vulnerability in the Pinpoint Booking System, allowing exploitation of incorrectly configured access control security levels. Recommendations: For versions through 2.9.9.5.2, update to a version that addresses the Missing Authorization vulnerability to prevent exploitation of access control security levels. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthenticated settings changes, potentially leading to exploitation. The vulnerability affects the Woo Multi Currency plugin for WordPress.

The issue is related to a Missing Authorization vulnerability in the Enhanced Text Widget, which allows exploiting incorrectly configured access control security levels.

The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels.

The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This can lead to unauthorized access and potentially other security issues. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and also store malicious scripts that can be executed by other users.

The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows Code Injection. This means an attacker can trick a user into performing unintended actions on a web application, potentially leading to the execution of malicious code.

The issue is a Server-Side Request Forgery (SSRF) vulnerability. This means that an attacker could potentially force the server to make unintended requests, leading to various security issues.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Reflected XSS.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS, where an attacker can inject malicious scripts into a website, potentially affecting users who visit the compromised page. The vulnerability is present in the Portfoliohub WordPress Portfolio Builder – Portfolio Gallery plugin.

The issue is a Cross-Site Request Forgery (CSRF) vulnerability that also allows Stored XSS in the Pinpoint Booking System.

The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS) or Stored XSS. This allows Stored XSS attacks, which can be executed by an attacker.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks.

The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability that also allows Cross-Site Scripting (XSS).

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS.

Name of the Vulnerable Software and Affected Versions: Event Management Tickets Booking versions 1.4.0 and earlier Description: The issue is related to the exposure of sensitive information to unauthorized actors. This is a problem where sensitive data is made available to individuals who should not have access to it. Recommendations: For versions 1.4.0 and earlier, update to a version that contains a fix for this issue, as the current version exposes sensitive information to unauthorized actors. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the exposure of sensitive information to an unauthorized actor. This could potentially lead to the leak of sensitive information.