Archive
6 June 2023
Vulnerabilities first published on this day (UTC), newest first.
149 results · Feed
-
High 7.6
Mandatory control bypass in Lime2
Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users within a Foundry organization to bypass discretionary or mandatory access controls under certain circumstances.
-
Low 3.5
URL deny list bypass via oEmbed and image URLs when generating previews in Synapse
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is…
-
Medium 5.4
Improper checks for deactivated users during login in synapse
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web T…
-
High 8.4
Verification bypass can cause users into verifying the wrong artifact
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-g…
-
Medium 5.4
Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verif…
-
Low 2.6
Denial of service from high number of artifact signatures in notation
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation inspe…
-
Medium 4.1
Grafana has Broken Access Control in Alert manager: Viewer can send test alerts
Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the …
-
High 7.5
Grafana Missing Synchronization vulnerability
Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mi…
-
High 8.1CVE-2023-33977 Public exploit
Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potential…
-
Medium 4.6
Cross-site Scripting (XSS) in Web GUI in syncthing
Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device loo…
-
High 7.5
Regex Injection via Doctype Entities
fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML bo…
-
High 7.8
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This cou…
-
High 7.8
The affected application lacks proper validation of user-supplied data when parsing font files (e.g., FNT). This could …
-
High 7.8
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This cou…
-
High 8.1
Command Injection Vulnerability in `Release PR Merged` Workflow in taosdata/grafanaplugin
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code execution within the github action context due to the insecure usage of `${{ github.event.pull_request.t…
-
High 7.8
The affected product does not properly validate user-supplied data. If a user opens a maliciously formed CSP file, then…
-
High 7.8
Horner Automation Cscape Out-of-bounds Read
Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to potentially execute arbitrary code in the context of the …
-
High 7.8
Horner Automation Cscape Out-of-bounds Write
Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e374b. An attacker could leverage this vulnerability to execute arbitrary code in …
-
High 7.8
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This cou…
-
High 7.8
The affected application lacks proper validation of user-supplied data when parsing project files (e.g.., CSP). This co…
-
High 7.8
Horner Automation Cscape Out-of-bounds Write
Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds write at CScape_EnvisionRV+0x2e3c04. An attacker could leverage this vulnerability to potentially execute arbitr…
-
Medium 6.1
Landscape Open Redirect
Landscape allowed URLs which caused open redirection.
-
Critical 9.3
Landscape's Apache server-status is accessible by default
Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attack and leak further information from the Landscape API.
-
Medium 6.8
Landscape insecure token generation
Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator.
-
High 7.8
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This cou…
-
Medium 6.5
Retrieval of Attachments to Comments lacks Authorization
A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment UUID into other arbi…
-
Medium 6.7
In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Unscored —
In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation…
-
Unscored —
In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation…
-
Medium 6.7
In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of …
-
Medium 6.7
In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of …
-
Medium 6.7
In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of …
-
Medium 6.7
In keymange, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation…
-
Medium 6.7
In keymange, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation…
-
Medium 4.1
In swpm, there is a possible out of bounds write due to a race condition. This could lead to local information disclosu…
-
Medium 6.7
In swpm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of …
-
Medium 4.4
In vcu, there is a possible memory corruption due to type confusion. This could lead to local denial of service with Sy…
-
Medium 6.7
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privile…
-
Medium 6.7
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privile…
-
Medium 6.7
In vcu, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with …