Archive
26 September 2023
Vulnerabilities first published on this day (UTC), newest first.
166 results · Feed
-
Medium 4.6
Weak password of selenium VNC in MeterSphere
MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can …
-
High 7.7
File deletion through document upload process in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Us…
-
Medium 6.5
SQL injection in ITIL actors in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field from the Ticket form can be used to perf…
-
Medium 5.3
Phishing through a login page malicious URL in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The lack of path filtering on the GLPI URL may allow an attacker to …
-
High 8.1CVE-2023-41326 EPSS 37%
Account takeover via Kanban feature in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to alte…
-
High 8.1
Account takeover through API in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user that have read access on users resource can steal accoun…
-
Medium 5.3CVE-2023-41323 EPSS 34%
Users login enumeration by unauthenticated user in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can enumerate users logins. Users are advise…
-
Medium 4.9
Privilege Escalation from technician to super-admin in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can make requests to change…
-
Medium 6.8
Symantec Protection Engine Hash Leak Vulnerability
Symantec Protection Engine, prior to 9.1.0, may be susceptible to a Hash Leak vulnerability.
-
Medium 4.3
Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plaintext.
-
Critical 9.9
Authenticated RCE due to unsafe JSON deserialization
Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the network_traffic API endpoint. An attacker can …
-
Medium 4.9
Sensitive fields enumeration through API in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user can enumerate sensitive fields values on resources on wh…
-
High 8.1CVE-2023-41320 EPSS 36%
Account takeover via SQL Injection in UI layout preferences in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. UI layout preferences management can be hijacked to lead to SQL inje…
-
Medium 5.9
Denial of service from circular relationship definitions in OpenFGA
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship defin…
-
Low 3.7
Temporary storage of plaintext passwords during password changes in matrix synapse
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it a…
-
Low 3.1
Improper validation of receipts allows forged read receipts in matrix synapse
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mar…
-
High 8.9CVE-2023-42819 Public exploit
Path traversal in Jumpserver
JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu and create a playbook named 'test'. Get the playbook id from the detail page, like 'e0adabef-c38f-4…
-
High 7.0CVE-2023-42820 Public exploit
Random seed leakage in Jumpserver
JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are…
-
Low 3.5
Denial of service via Kubernetes annotations in specific Cilium configurations
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with `policy.cilium.io/proxy-visibility` annotations (in Cilium >= v1.13) or `io.c…
-
Medium 6.9
Bypass of namespace restrictions in CiliumNetworkPolicy
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CiliumNetworkPolicy objects in a particular namespace is able to affect traffic on an entire Cilium cluster, potentiall…
-
Unscored —
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. An app may be a…
-
Unscored —
The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17. An app may be able to gain r…
-
Critical 10.0
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed pro…
-
Unscored —
The issue was addressed with improved handling of caches. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS…
-
Unscored —
An authorization issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6, tvOS 17…
-
High 7.8
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14. An app may…
-
Medium 5.5
An authentication issue was addressed with improved state management. This issue is fixed in watchOS 10. An Apple Watch…
-
Unscored —
A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS So…
-
Unscored —
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in tvOS 17, iOS…
-
Unscored —
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14. An app may be able to ca…
-
Unscored —
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.7, iOS 17 a…
-
High 7.8
The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app …
-
Unscored —
This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 15. An app may be able to access Ap…
-
Unscored —
The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10…
-
Unscored —
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and…
-
Unscored —
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS…
-
High 7.8
An access issue was addressed with improved access restrictions. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, …
-
Unscored —
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and…
-
Unscored —
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. An app…
-
Unscored —
The issue was addressed with improved handling of caches. This issue is fixed in tvOS 17, iOS 16.7 and iPadOS 16.7, mac…