Archive
August 2023
Vulnerabilities first published in this month (UTC), newest first.
772 results · Clear filters · Feed
-
Medium 5.3
IBM Cognos Analytics information disclosure
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconnaissance to gather information that could be used for future attacks. IBM X-Force ID: 257703.
-
Medium 5.3
A vulnerability in the Tomcat implementation for Cisco Unified Contact Center Express (Unified CCX) could allow an unau…
-
Medium 5.5
A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an …
-
Medium 4.8
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Netw…
-
Medium 4.8
Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programm…
-
Medium 6.5
Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to…
-
Medium 6.5
Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to…
-
Medium 6.5
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authentica…
-
Medium 6.5
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform …
-
Medium 4.3
A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access inter…
-
Medium 6.5
A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communica…
-
Medium 4.8
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unifi…
-
Medium 6.1
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an un…
-
Medium 5.3
Timing Attack Reveals CSRF Tokens in oppia
Oppia is an online learning platform. When comparing a received CSRF token against the expected token, Oppia uses the string equality operator (`==`), which is not safe against timing attacks. By repeatedly submitting invalid tokens, an attacker can brute-for…
-
Medium 4.6
Dell BIOS contains an improper authentication vulnerability. A malicious user with physical access to the system may po…
-
Medium 6.9
Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. A local authenticated malicious user with physical…
-
Medium 5.9
IBM WebSphere Application Server Liberty denial of service
IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-…
-
Medium 5.5
Kernel: jfs: null pointer dereference in dbfree()
A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check.
-
Medium 5.7
Improper securing of log directory may allow a denial of service
Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation.
-
Medium 5.4
NPort IAW5000A-I/O Series Hardcoded Credential Vulnerability
NPort IAW5000A-I/O Series firmware version v2.2 and prior is affected by a hardcoded credential vulnerabilitywhich poses a potential risk to the security and integrity of the affected device. This vulnerability is attributed to the presence of a hardcoded key…
-
Medium 4.3
Jenkins Favorite View Plugin cross-site request forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Favorite View Plugin 5.v77a_37f62782d and earlier allows attackers to add or remove views from another user's favorite views tab bar.
-
Medium 6.5
Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure
Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.
-
Medium 6.5
Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure
The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output.
-
Medium 4.3
Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin vulnerable to exposure of system-scoped credentials
Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.
-
Medium 4.3
Jenkins Delphix Plugin vulnerable to exposure of system-scoped credentials
Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read permission to access and capture credentials they are not entitled to.
-
Medium 4.3
Jenkins Delphix Plugin missing permission check
A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
-
Medium 5.4
Jenkins Blue Ocean Plugin cross-site request forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job.
-
Medium 4.3
Jenkins Config File Provider Plugin improper credential masking vulnerability
Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log.
-
Medium 4.3
Jenkins NodeJS Plugin improper credential masking vulnerability
Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file in Pipeline build logs.
-
Medium 4.3
Jenkins Folders Plugin information disclosure vulnerability
Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available, exposing information about the Jenkins controlle…
-
Medium 4.3
Jenkins Folders Plugin cross-site request forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.
-
Medium 5.3
Dell PowerScale OneFS 9.5.0.x contains an incorrect default permissions vulnerability. A low-privileged local attacker …
-
Medium 6.3
Dell PowerScale OneFS 9.5.0.x, contains an insertion of sensitive information into log file vulnerability in SNMPv3. A …
-
Medium 6.7
Dell PowerScale OneFS 8.2x -9.5x contains an improper privilege management vulnerability. A high privilege local attack…
-
Medium 6.7
Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability. A local attacker with high privileges c…
-
Medium 5.3
Dell PowerScale OneFS, 8.2.x-9.5.0.x, contains an information disclosure vulnerability in NFS. A low privileged attacke…
-
Medium 6.7
Dell PowerScale OneFS 9.5.x version contain a privilege escalation vulnerability. A low privilege local attacker could …
-
Medium 6.7
Dell PowerScale OneFS, 8.0.x-9.5.x, contains an improper handling of insufficient privileges vulnerability. A local pri…
-
Medium 6.1
WP EasyPay < 4.1 - Reflected Cross-Site Scripting
The WP EasyPay WordPress plugin before 4.1 does not escape some generated URLs before outputting them back in pages, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
-
Medium 4.3
Unverified Password Change in instantsoft/icms2
Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.