Archive
August 2023
Vulnerabilities first published in this month (UTC), newest first.
2,514 results · Feed
-
Medium 5.7
Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when acces…
-
High 7.1
The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized…
-
High 7.6
The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before get…
-
Medium 4.3
External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, in…
-
Low 3.5
Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could b…
-
Medium 4.3
Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions
The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
-
Medium 6.1
Bus Ticket Booking with Seat Reservation <= 5.2.3 - Reflected Cross-Site Scripting
The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_date' and 'tab_date_r' parameters in versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping…
-
Medium 4.3
Missing Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on prot…
-
Medium 4.8
Improper Control of Generation of Code ('Code Injection') in GitLab
An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to cre…
-
Unscored —
Improper input validation vulnerability in SEIKO EPSON printer Web Config allows a remote attacker to turned off the pr…
-
Medium 4.3
Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS.
-
Medium 5.5
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows en…
-
Low 2.5
Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability …
-
Medium 5.5
In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoi…
-
High 7.1
Arbitrary File Overwrite using less command
System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0.
-
Medium 4.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML di…
-
Medium 4.3
Improper Validation of Specified Type of Input in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not loa…
-
Medium 4.9
Insertion of Sensitive Information into Log File in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a spec…
-
High 7.5
Inefficient Regular Expression Complexity in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending …
-
Medium 5.3
An information disclosure in the web interface of Brocade Fabric OS
An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated attacker to get technical details about the web interface.
-
Unscored —CVE-2023-33383 Public exploit
Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition …
-
Unscored —
Verint Engagement Management 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat.
-
Unscored —
ngiflib commit fb271 was discovered to contain a segmentation violation via the function "main" at gif2tag.c. This vuln…
-
Unscored —
ngiflib commit 84a75 was discovered to contain a segmentation violation via the function SDL_LoadAnimatedGif at ngiflib…
-
Unscored —
OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administra…
-
Unscored —
Cross Site Scripting vulnerability in GatesAIr Flexiva FM Transmitter/Exciter v.FAX 150W allows a remote attacker to ex…
-
High 7.0
Xiaomi router external request interface has command injection
Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or upp…
-
Unscored —
A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's wh…
-
Unscored —CVE-2022-46485 Public exploit
Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a surve…
-
Unscored —CVE-2022-46484 Public exploit
Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and be…
-
High 7.8
Privilege issues in multiple commands
Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain root privileges in Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c and v9.2.0.
-
Medium 6.3
XSS vulnerability in Brocade Webtools
A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html of Brocade Fabric OS version before Brocade Fabric OS v9.2.0 that could allow a remote unauthenticated attacker to execute arbitrary JavaScript code in a target u…
-
Medium 5.5
CLI allows upload or transfer files of dangerous types
Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user's home directory using grep.
-
Medium 6.5
Inefficient Regular Expression Complexity in GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted …
-
Low 3.1
Generation of Error Message Containing Sensitive Information in GitLab
An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for group…
-
Medium 5.4CVE-2023-2164 EPSS 66%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability…
-
High 7.5CVE-2023-3364 EPSS 44%
Inefficient Regular Expression Complexity in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending…
-
Medium 6.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export…
-
Medium 5.5
buffer overflow vulnerability in “secpolicydelete” command
A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated privileged user to crash the Brocade Fabric OS switch leading to a denial of service.
-
Medium 5.5
A buffer overflow vulnerability in “diagstatus” command
A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to crash the Brocade Fabric OS switch leading to a denial of service.