Archive
26 July 2023
Vulnerabilities first published on this day (UTC), newest first.
73 results · Feed
-
Unscored —
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A us…
-
Medium 5.5CVE-2023-38606 Exploited
This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and i…
KEV Jul 26, 2023 -
Unscored —
The issue was addressed with improvements to the file handling protocol. This issue is fixed in iOS 16.6 and iPadOS 16.…
-
Unscored —
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This iss…
-
Unscored —
The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS …
-
Unscored —
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.6.8, iOS…
-
Unscored —
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS B…
-
Unscored —
This issue was addressed with improved data protection. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.…
-
Unscored —
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.6.8, iOS…
-
Unscored —
The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS …
-
Unscored —
The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS …
-
Medium 6.6
HCL BigFix Mobile can be affected by a cross-site scripting (XSS) vulnerability
HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application.
-
High 8.8
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6…
KEV Jul 13, 2023 -
Medium 5.4
HCL BigFix Mobile can be affected by a command injection vulnerability
HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server.
-
Medium 6.5
HCL Verse is susceptible to a Reflected Cross-Site Scripting (XSS) Vulnerability
HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability. By tricking a user into entering crafted markup a remote, unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or stea…
-
Unscored —
Carefully crafted input by an attacker will not be sanitized by this module, which can result in a script injection.
-
Unscored —
The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator int…
-
High 7.7
Missing Authorization in Jenkins plug-in for ServiceNow DevOps
A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version …
-
Medium 6.1
Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps
A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 ver…
-
High 8.6
Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows…
-
Medium 4.3
CVE-2023-30949
A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks.
-
High 7.2
SolarWinds Network Configuration Manager Directory Traversal Vulnerability
The SolarWinds Network Configuration Manager was susceptible to the Directory Traversal Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands.
-
Medium 4.3
Access Control Bypass Vulnerability in the SolarWinds Platform
Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource
-
Low 3.5
SolarWinds Platform Incorrect Input Neutralization Vulnerability
The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject passive HTML.
-
Critical 9.8
A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3…
-
High 7.2
SolarWinds Platform Incorrect Comparison Vulnerability
The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands.
-
Medium 4.3
CSRF vulnerability in Bazaar Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.
-
Low 3.1
Secret displayed without masking by Chef Identity Plugin
Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.
-
Medium 4.2
Incorrect permission checks in Qualys Web App Scanning Connector Plugin allow capturing credentials
Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another …
-
Medium 5.4
CSRF vulnerability in GitLab Authentication Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.
-
High 8.0
Jenkins Stored Cross-site Scripting vulnerability
Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build lo…
-
Medium 6.5
Incorrect control flow in Jenkins Gradle Plugin breaks credentials masking in the build log
Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.
-
High 7.2
SolarWinds Platform Incorrect Behavior Order Vulnerability
The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges.
-
High 7.2
SolarWinds Platform Deserialization of Untrusted Data Vulnerability
The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges.
-
High 7.2
SolarWinds Platform Incomplete List of Disallowed Inputs Vulnerability
The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges.
-
Medium 5.2
In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions
-
Critical 9.6
Command injection in fs.py
PaddlePaddle before 2.5.0 has a command injection in fs.py. This resulted in the ability to execute arbitrary commands on the operating system.
-
Medium 4.7
FPE in paddle.linalg.matrix_power
FPE in paddle.trace in PaddlePaddle before 2.5.0. This flaw can cause a runtime crash and a denial of service.
-
High 8.3
Heap buffer overflow in paddle.trace
Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.
-
High 7.2CVE-2023-28130 EPSS 21%
Local user may lead to privilege escalation using Gaia Portal hostnames page.