Archive
August 2023
Vulnerabilities first published in this month (UTC), newest first.
772 results · Clear filters · Feed
-
Medium 6.1
Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in.
-
Medium —
Blst has logical error in SigValidate in Go bindings
### Impact Blst versions v0.3.0 through 0.3.10 failed to perform a signature group-check if the call to `SigValidate` in the Go bindings was complemented with a check for infinity. Formally speaking, infinity, or the identity element of the elliptic curve gro…
-
Medium 6.4
Use of a broken cryptographic algorithm affects HCL DRYiCE iAutomate
HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
-
Medium 6.4
Use of a broken cryptographic algorithm affects HCL DRYiCE MyCloud
HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
-
Medium 6.5
Sentry vulnerable to incorrect credential validation on OAuth token requests
Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due …
-
Medium 5.9
uthenticode EKU validation bypass
uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Versions of uthenticode prior to the 2.x series did not check Extended Key Usages in certificates, in violation of the Authenticode X.509 certificate profil…
-
Medium 6.0
Kernel: exfat: stack overflow in exfat_get_uniname_from_ext_entry
A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging …
-
Medium 5.3
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could caus…
-
Medium 4.9
DoS via SAML configuration in Guardian/CMC before 22.6.2
An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every subsequent application request will return an error. The whole application in rendered unusable until a…
-
Medium 4.3
Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2
A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null. The reports section will be partially unavailable for all later attempts to use it, wit…
-
Medium 6.5
Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2
An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality. An authenticated user with reduced visibility can obtain unauthorized information via the debug functiona…
-
Medium 6.4
Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2
An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the…
-
Medium 5.5
ZDI-CAN-21094: Adobe Dimension GLB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Dimension version 3.4.9 is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user inte…
-
Medium 6.5
Adobe Commerce Incorrect Authorization Security feature bypass
Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerabilit…
-
Medium 4.9
PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password.
-
Medium 4.3
PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt browser.
-
Medium 4.3
PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem through a configuration dialog within the embedded Qt browser .
-
Medium 4.3
FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check
The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above …
-
Medium 5.7
The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a lo…
-
Medium 5.9
Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an…
-
Medium 5.5
Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user…
-
Medium 6.5
Instrumentation for AWS SDK v2 captures email content when using Amazon Simple Email Service (SES) v1 API, exposing that content to the telemetry backend
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. OpenTelemetry Java Instrumentation prior to version 1.28.0 contains an issue related to the instrumentation of Java applications using the A…
-
Medium 6.2
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
-
Medium 5.4
social-media-skeleton stored Cross-site Scripting vulnerability
social-media-skeleton is an uncompleted social media project implemented using PHP, MySQL, CSS, JavaScript, and HTML. Versions 1.0.0 until 1.0.3 have a stored cross-site scripting vulnerability. The problem is patched in v1.0.3.
-
Medium 6.1
Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable in…
-
Medium 5.3
Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service …
-
Medium 5.9
Buffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via netwo…
-
Medium —
Several quadratic complexity bugs may lead to denial of service in Commonmarker
## Impact Several quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service. The following vulnerabilities were addressed: * [CV…
-
Medium 6.5
Microsoft SharePoint Server Information Disclosure Vulnerability
Microsoft SharePoint Server Information Disclosure Vulnerability
-
Medium 6.5
Microsoft Outlook Spoofing Vulnerability
Microsoft Outlook Spoofing Vulnerability
-
Medium 6.5
Microsoft SharePoint Server Information Disclosure Vulnerability
Microsoft SharePoint Server Information Disclosure Vulnerability
-
Medium 4.5
Azure Apache Ambari Spoofing Vulnerability
Azure Apache Ambari Spoofing Vulnerability
-
Medium 4.5
Azure Apache Oozie Spoofing Vulnerability
Azure Apache Oozie Spoofing Vulnerability
-
Medium 4.5
Azure Apache Hadoop Spoofing Vulnerability
Azure Apache Hadoop Spoofing Vulnerability
-
Medium 4.5
Azure Apache Hive Spoofing Vulnerability
Azure Apache Hive Spoofing Vulnerability
-
Medium 4.6
Azure HDInsight Jupyter Notebook Spoofing Vulnerability
Azure HDInsight Jupyter Notebook Spoofing Vulnerability
-
Medium 6.5
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
-
Medium 5.4
Windows HTML Platforms Security Feature Bypass Vulnerability
Windows HTML Platforms Security Feature Bypass Vulnerability
-
Medium 6.5
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
-
Medium 6.5
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability