Archive
4 October 2023
Vulnerabilities first published on this day (UTC), newest first.
107 results · Feed
-
High 7.5
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled
Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, remote attacker to bypass public key authentication when keyboard-interactive SSH authentication is a…
-
Medium 5.0
The Altair Desktop Client Does Not Sanitize External URLs before passing them to the underlying system
Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system. Moreover, Altair GraphQL Client also does not isolate the context of the renderer p…
-
High 7.5
Nexkey allows users to bypass authentication of Bull dashboard
Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this iss…
-
High 7.5
Misskey allows users to bypass authentication of Bull dashboard
Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. Th…
-
Low 3.1
Zope management interface vulnerable to stored cross site scripting via the title property
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 ar…
-
Critical 10.0
Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNet
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration This issue a…
-
High 7.3
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
Medium 5.6
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Prote…
-
Critical 9.7
Redisson unsafe deserialization vulnerability
Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers that manage to trick clients in…
-
Medium 6.1
Common Voice Cross-site Scripting vulnerability
Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets for training voice recognition-related tools. Version 1.88.2 is vulnerable to reflected Cross-Site Scripting given that …
-
Medium 5.0
A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could h…
-
Medium 5.6
A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incom…
-
High 8.1
Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits
Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting po…
-
High 8.1
Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline
Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed (Close trans…
-
Critical 9.1
Hydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyone
Hydra is the layer-two scalability solution for Cardano. Users of the Hydra head protocol send the UTxOs they wish to commit into the Hydra head first to the `commit` validator, where they remain until they are either collected into the `head` validator or th…
-
Critical 9.8
A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary cod…
-
Critical 9.8CVE-2023-5399 EPSS 36%
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that coul…
-
High 8.2
Kernel: ebpf: insufficient stack type checks in dynptr
An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF …
-
Medium 5.5
Libtiff: memory leak in tiffcrop.c
A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an applicatio…
-
Medium 6.2
Imagemagick: heap-buffer-overflow in coders/tiff.c
A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a specially crafted file, resulting in an application crash and denial of service.
-
High 7.8
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may…
KEV Oct 5, 2023 -
Critical 9.8
A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfe…
-
Medium 6.5
A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrast…
-
High 8.6
A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, re…
-
Critical 9.8
A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected d…
-
Medium 5.9CVE-2023-43804 Public exploit
`Cookie` HTTP header isn't stripped on cross-origin redirects
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…
-
Medium 5.3
Memory Allocation with Excessive Size Value in Wireshark
RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file
-
Unscored —
This module enables users to log in by email address with minimal configurations. Drupal core contains protection again…
-
Medium 6.5
SQL injection vulnerability in TCMAN GIM
The 'sReferencia', 'sDescripcion', 'txtCodigo' and 'txtDescripcion' parameters, in the frmGestionStock.aspx and frmEditServicio.aspx files in TCMAN GIM v8.0.1, could allow an attacker to perform persistent XSS attacks.
-
Critical 9.9
SQL injection vulnerability in TCMAN GIM
TCMAN GIM v8.0.1 is vulnerable to a SQL injection via the 'SqlWhere' parameter inside the function 'BuscarESM'. The exploitation of this vulnerability might allow a remote attacker to directly interact with the database.
-
Medium 5.3
Garuda Linux Improper Authorization
Garuda Linux performs an insecure user creation and authentication that allows any user to impersonate the created account. By creating users from the 'Garuda settings manager', an insecure procedure is performed that keeps the created user without an assigne…
-
High 7.5
Zod denial of service vulnerability during email validation
### Impact API servers running `express-zod-api` having: - version of `express-zod-api` below `10.0.0-beta1`, - and using the following (or similar) validation schema in its implementation: `z.string().email()`, are vulnerable to a DoS attack due to: - Ineffi…
-
Medium 5.5
A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable th…
-
High 7.3CVE-2023-3971 Public exploit
Controller: html injection in custom login info
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
-
Medium 6.3
Platform: token exposed at importing project
A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality…
-
High 7.3
Platform: ec2_key module prints out the private key directly to the standard output
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's con…
-
Unscored —
Certain HP Enterprise LaserJet, LaserJet Managed printers - Potential denial of service, potential Cross Site Scripting (XSS)
Certain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to denial of service due to WS-Print request and potential injections of Cross Site Scripting via jQuery-UI.
-
Medium 4.3
WordPress WooCommerce Dynamic Pricing and Discount Rules Plugin <= 2.4.0 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Dynamic Pricing and Discount Rules for WooCommerce plugin <= 2.4.0 versions.
-
Critical 10.0
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploite…
KEV Oct 5, 2023 -
Medium 5.4
Enhanced Ecommerce Google Analytics for WooCommerce
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Enhanced Ecommerce Google Analytics for WooCommerce plugin <= 3.7.1 versions.