Archive
13 July 2023
Vulnerabilities first published on this day (UTC), newest first.
114 results · Feed
-
Critical 9.8
vm2 Sandbox Escape vulnerability
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypas…
-
Medium 6.8
GLPI vulnerable to SQL injection via dashboard administration
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in versi…
-
Low 3.1
System logs spoofable in Auto-GPT via ANSI control sequences
Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of color-coded print statements to signify different types of system messages to the user, including mess…
-
High 7.6
Python code execution sandbox escape in non-docker version in Auto-GPT
Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. When Auto-GPT is executed directly on the host system via the provided run.sh or run.bat files, custom Python code execution is sandboxed using a temp…
-
High 8.1CVE-2023-37273 Public exploit
Docker escape in Auto-GPT when running from docker-compose.yml included in git repo
Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. Running Auto-GPT version prior to 0.4.3 by cloning the git repo and executing `docker compose run auto-gpt` in the repo root uses a different docker-c…
-
Medium 6.3
XSS vulnerability in JOC Cockpit branch 1.13
JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerab…
-
Medium 6.8
CSP nonce reuse vulnerability in Discourse
Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would a…
-
High 7.5
Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of p…
-
Medium 6.0
Storing unencrypted LDAP passwords in feedbacksystem
Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in…
-
Medium —
Tokenizer vulnerable to client brute-force of token secrets
### Impact Authorized clients, having an `inject_processor` secret, could brute-force the secret token value by abusing the `fmt` parameter to the `Proxy-Tokenizer` header. ### Patches This was fixed in https://github.com/superfly/tokenizer/pull/8 and further…
-
Medium 6.4
Quadratic complexity bugs may lead to a denial of service
cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of se…
-
Low 3.5
CQI Data Sniffing
An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.
-
Medium 6.9
Stored Cross-Site Scripting on Device Import Functionality
Alaris Systems Manager does not perform input validation during the Device Import Function.
-
High 8.2
Stored Cross-Site Scripting on User Import Functionality
A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.
-
Low 3.0
Lack of Dataset Integrity Checking
A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs.
-
Medium 6.1
Lack of Cryptographic Security of IUI Bus
The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a specially crafted device while an infusion is running.
-
Medium 6.8
PCU Configuration Lacks Authentication
The configuration from the PCU can be modified without authentication using physical connection to the PCU.
-
High 7.1
mx-chain-go's relayed transactions always increment nonce
mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have c…
-
Medium 5.2
Wireless Card Firmware Improperly Signed
The firmware update package for the wireless card is not properly signed and can be modified.
-
High 7.0
Heap overflow issue with the Lua cjson library used by Redis
Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions…
-
High 7.5
Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions
Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.
-
Critical 9.8
SQL in VegaGroup Web Collection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VegaGroup Web Collection allows SQL Injection. This issue affects Web Collection: before 31197.
-
Medium 6.3
SourceCodester AC Repair and Services System sql injection
A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. This affects an unknown part of the file /classes/Master.php?f=save_inquiry. The manipulation of the argument id leads to sql injection. It is p…
-
Low 2.4
Campcodes Retro Cellphone Online Store add_user_modal.php cross site scripting
A vulnerability was found in Campcodes Retro Cellphone Online Store 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/add_user_modal.php. The manipulation of the argument un leads to cross site scriptin…
-
Critical 9.1
Embedded malicious code vulnerability in Unitronics Vision1210
Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a…
-
High 7.5
Server Data type confusion - info leak
Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
High 7.5
Controller DOS on sending error response
Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning. See Honeywell Security Notification for recommendations on up…
-
Low 3.5
SourceCodester AC Repair and Services System cross site scripting
A vulnerability has been found in SourceCodester AC Repair and Services System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/?page=user/manage_user. The manipulation of the argument firstname/m…
-
Critical 9.8
Controller stack overflow on decoding messages from the server
Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
Controller design flaw - unsigned firmware
Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
DoS due to heap overflow
Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
Controller stack overflow when decoding messages from the server
Controller DoS due to stack overflow when decoding a message from the server. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
High 7.5
Server deserialization missing boundary checks - heap overflow in communication between server and controller
Experion server may experience a DoS due to a heap overflow which could occur when handling a specially crafted message
-
Critical 9.8
Server DoS due to heap overflow
Experion server DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
High 7.5
Server bad parsing implementation - stack overflow in server::get_db_path_for_driver
Experion server may experience a DoS due to a stack overflow when handling a specially crafted message.
-
Medium 6.3
SourceCodester AC Repair and Services System HTTP POST Request sql injection
A vulnerability, which was classified as critical, was found in SourceCodester AC Repair and Services System 1.0. Affected is an unknown function of the file Master.php?f=delete_book of the component HTTP POST Request Handler. The manipulation of the argument…
-
Medium 6.3
SourceCodester AC Repair and Services System HTTP POST Request sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester AC Repair and Services System 1.0. This issue affects some unknown processing of the file Master.php?f=save_book of the component HTTP POST Request Handler. The manipulation o…
-
Medium 6.3
Insufficient validation of Action form input fields
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of m…
-
Medium 5.9
Duktape 2.6 bug crashes JavaScript putting too many values in valstack.
Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.
-
Medium 5.7
Inefficient URL schema validation
URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards.