Archive
8 March 2023
Vulnerabilities first published on this day (UTC), newest first.
17 results · Clear filters · Feed
-
High 7.5
Incorrect multiplication of unreduced P-256 scalars in filippo.io/nistec
Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this.
-
High 8.1
Insufficient authorization validation between zones when xCAT zones are enabled
xCAT is a toolkit for deployment and administration of computer clusters. In versions prior to 2.16.5 if zones are configured as a mechanism to secure clusters in XCAT, it is possible for a local root user from one node to obtain credentials to SSH to any nod…
-
High 7.8
kylin-system-updater Update InstallSnap command injection
A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be ap…
-
High 7.5
Denial of service in Jenkins Core
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trig…
-
High 7.0
Incorrect Authorization in Jenkins Core
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a plugin for installation, potentially allowing attackers with access to the Jen…
-
High 7.5
Denial of service in Jenkins Core
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to …
-
High 7.8
A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could all…
-
High 8.8CVE-2023-0089 Public exploit
Proofpoint Enterprise Protection webutils authenticated RCE
The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'. This affects all versions 8.20.0 and below.
-
High 7.8
A use-after-free flaw was found in the Linux kernel’s nouveau driver in how a user triggers a memory overflow that caus…
-
High 8.8
feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low pe…
-
High 7.5
There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploi…
-
High 7.5
SmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files, which could exhaust the …
-
High 8.1
There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited…
-
High 7.5
onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.
-
High 7.5
Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position …
-
High 8.8
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing opera…
-
High 7.5
REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified.