Archive
16 February 2023
Vulnerabilities first published on this day (UTC), newest first.
96 results · Clear filters · Feed
-
Medium 4.3
Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. It allows a us…
-
Medium 5.3
Palantir Gotham included an endpoint that would log arbitrary sized payloads.
Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service.
-
Medium 5.3
Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session.
Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that…
-
Medium 6.3
It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net…
-
Medium 5.3
Palantir Gotham included an endpoint that would log arbitrary sized zip files.
Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources …
-
Medium 6.1
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects …
-
Medium 6.3
It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.ne…
-
Medium 6.1
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects …
-
Medium 6.1
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects …
-
Medium 6.1
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects …
-
Medium 5.7
Gotham Chat IRC help does not validate hostnames in TLS certificates
Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middl…
-
Medium 6.3
It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net…
-
Medium 4.9
SiteServerCMS 7.1.3 sscms has a file read vulnerability.
-
Medium 5.4
Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via descript…
-
Medium 6.1
Cross-site scripting in Bleach
A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of t…
-
Medium 6.1
Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.