Archive
26 September 2023
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
Medium 4.6
Weak password of selenium VNC in MeterSphere
MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can …
-
Medium 6.5
SQL injection in ITIL actors in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field from the Ticket form can be used to perf…
-
Medium 5.3
Phishing through a login page malicious URL in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The lack of path filtering on the GLPI URL may allow an attacker to …
-
Medium 5.3CVE-2023-41323 EPSS 34%
Users login enumeration by unauthenticated user in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can enumerate users logins. Users are advise…
-
Medium 4.9
Privilege Escalation from technician to super-admin in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can make requests to change…
-
Medium 6.8
Symantec Protection Engine Hash Leak Vulnerability
Symantec Protection Engine, prior to 9.1.0, may be susceptible to a Hash Leak vulnerability.
-
Medium 4.3
Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plaintext.
-
Medium 4.9
Sensitive fields enumeration through API in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user can enumerate sensitive fields values on resources on wh…
-
Medium 5.9
Denial of service from circular relationship definitions in OpenFGA
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship defin…
-
Medium 6.9
Bypass of namespace restrictions in CiliumNetworkPolicy
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CiliumNetworkPolicy objects in a particular namespace is able to affect traffic on an entire Cilium cluster, potentiall…
-
Medium 5.5
An authentication issue was addressed with improved state management. This issue is fixed in watchOS 10. An Apple Watch…
-
Medium 5.3CVE-2023-36851 Exploited
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php th…
KEV Nov 13, 2023 -
Medium 6.3
Potential off-by-one buffer overflow vulnerability in the Zephyr FS subsystem
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.
-
Medium 5.3
_abi_decode input not validated in complex expressions in Vyper
Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi_decode()` can be constructed which allow for bounds checking to be bypassed resulting in incorrect …
-
Medium 6.5
Palantir Gotham UI bug that could lead to incorrect data classification
Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link.
-
Medium 4.1
Stored XSS via javascript URI in Apollo Change Requests comment
In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.
-
Medium 6.7
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative acces…
-
Medium 4.7
Security issue in SMP Gateway automation platform
Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platform, impacting the availability of the product. In rare situations, the issue could cause the SMP devi…
-
Medium 5.5
Operator: plaintext password in operator log
A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local attacker to access information outside of their permissions.
-
Medium 6.5
SiberianCMS - CWE-284: Improper Access Control Authorized user may disable a security feature over the network
SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network
-
Medium 5.8
WordPress Travel Map Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Cross-Site Scripting (XSS) vulnerability in TravelMap plugin <= 1.0.1 versions.
-
Medium 6.1
Excessive Data Query Operations in a Large Data Table in pimcore/demo
Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0.
-
Medium 6.4
Options for Twenty Seventeen <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Options for Twenty Seventeen plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social-links' shortcode in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. Thi…
-
Medium 6.4
Simple Cloudflare Turnstile <= 1.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Simple Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gravity-simple-turnstile' shortcode in versions up to, and including, 1.23.1 due to insufficient input sanitization and output escaping on user supplied att…
-
Medium 6.4
Modal Window <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Modal Window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authen…
-
Medium 5.3
Broadcast permission control vulnerability in the framework module. Successful exploitation of this vulnerability may c…