Archive
10 February 2023
Vulnerabilities first published on this day (UTC), newest first.
74 results · Feed
-
High 7.5
Server-Side Request Forgery in DataHub
DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this proxy is to perform authentication if needed and forward HTTP requests to the DataHub Metadata Stor…
-
High 7.5
Deserialization of untrusted data in DataHub
DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the `id_token` is done in an unsafe manner which is not properly accounted for by the DataHub f…
-
High 8.2
System account impersonation in DataHub
DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (GMS) will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request …
-
High 8.2
JSON Injection in DataHub
DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled dat…
-
Medium 5.7
Login fail open on JAAS misconfiguration in DataHub
DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service (JAAS) authentication and that system is given a configuration which contains an error, the authentication for the system will fail open …
-
Medium 6.9
Failure to Invalidate Session on Logout in DataHub
DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the `AuthUtils.hasValidSessionCookie()` method could be bypass…
-
High 8.1
Remote Code Execution in Baicells QRTB Platform
Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with…
-
High 8.7
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
Medium 6.8
Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin c…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A malicious admin user can disabl…
-
Medium 5.3
Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attac…
-
High 8.8
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain a command execu…
-
Medium 4.8
PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Stored Cross-site Scripting Vulnerabilit…
-
Medium 6.7
PowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability. An authenticated admin use…
-
Medium 6.0
PowerPath Management Appliance with versions 3.3 & 3.2* contains a Hardcoded Cryptographic Keys vulnerability. Authenti…
-
High 8.8
PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Cross-site Request Forgery vulnerability…
-
High 7.2
PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains OS Command Injection vulnerability. An aut…
-
High 8.8
PowerPath Management Appliance with versions 3.3 & 3.2* contains Authorization Bypass vulnerability. An authenticated r…
-
Medium 6.0
Dell PowerScale OneFS, versions 8.2.x through 9.3.x contain a weak encoding for a password. A malicious local privilege…
-
Medium 5.9
Dell PowerScale OneFS, versions 9.2.0.x through 9.4.0.x contain an information vulnerability. A remote unauthenticated …
-
Medium 6.5
Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module. A loc…
-
Medium 5.5
SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An aut…
-
Low 3.7
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated atta…
-
High 7.1
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior…
-
Medium 6.4
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior)…
-
Medium 5.5
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior)…
-
Medium 5.5
SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) con…
-
High 7.8
Dell SupportAssist Client Consumer (version 3.11.1 and prior), SupportAssist Client Commercial (version 3.2 and prior),…
-
Low 1.9
Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A …
-
Medium 4.5
set_term_title command injection in ipython
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific …
-
Low 3.9
Dell PowerEdge BIOS and Dell Precision BIOS contain an improper input validation vulnerability. A local authenticated m…
-
Medium 6.5
Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerabili…
-
Medium 4.4
Dell BSAFE SSL-J, versions before 6.5 and version 7.0 contain a debug message revealing unnecessary information vulnera…
-
High 7.7
Dell PowerScale OneFS, versions 8.2.x through 9.4.x contain multiple stored cross-site scripting vulnerabilities. A rem…
-
Medium 5.0
CodenameOne implicit intent for sensitive communication
A vulnerability was found in CodenameOne 7.0.70. It has been classified as problematic. Affected is an unknown function. The manipulation leads to use of implicit intent for sensitive communication. It is possible to launch the attack remotely. The complexity…
-
Medium 6.3
webbuilders-group silverstripe-kapost-bridge KapostService.php getPreview sql injection
A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.php. The manipulation leads to sql inject…
-
High 7.8
Dell Alienware Command Center versions 5.5.37.0 and prior contain an Improper Input validation vulnerability. A local a…
-
Medium 4.7
Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation. A…