Archive
19 October 2023
Vulnerabilities first published on this day (UTC), newest first.
105 results · Feed
-
High 8.4
Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli
Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key passw…
-
Medium 4.3
Account takeover via auth_callback login in Home Assistant Core
Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable when logging in. Consequently, the code parameter utilized to fetch the `access_token` post-authentication will be sent…
-
Medium 5.3
Local-only webhooks externally accessible via SniTun in Home Assistant Core
Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.casa` URL without authentication, even when the webhook is marked as Only accessible from the local n…
-
High 8.8
Cross-site Scripting via auth_callback login in Home Assistant Core
Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to another website that specifies the `redirect_uri` and `client_id` parameters. Although the `redirect_uri` …
-
High 7.1
Fake websocket server installation permits full takeover in Home Assistant Core
Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_callback=1`, which is leveraged by the WebSocket authentication logic in tandem with the `state` parameter. The state para…
-
High 8.8
Lack of XFO header allows clickjacking in Home Assistant Core
Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers fa…
-
Medium 6.6
Partial Server-Side Request Forgery in Home Assistant Core
Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service (e.g.: through GHSA-h2jp-7grc-9xpp) may be able to invoke …
-
High 8.6CVE-2023-41898 Public exploit
Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android
Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited nat…
-
High 8.6
Client-Side Request Forgery in Home Assistant iOS/macOS native Apps
The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistan…
-
Medium 6.1
Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin
TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a stri…
-
Medium 6.1
Cross-site Scripting vulnerability in TinyMCE notificationManager.open API
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions f…
-
Medium 6.4
ArchiveBox: Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context
ArchiveBox is an open source self-hosted web archiving system. Any users who are using the `wget` extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and vie…
-
High 7.5
Arbitrary file read in Artifact Hub
Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which by using symbolic links…
-
Low 3.7
Unsafe rego built-in allowed in Artifact Hub
Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which a default unsafe rego b…
-
Medium 5.4
Incorrect Docker Hub registry check in Artifact Hub
Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which the `registryIsDockerHu…
-
Critical 9.8
Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow
In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.
-
High 8.8
Weintek cMT3000 HMI Web CGI OS Command Injection
In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.
-
Critical 9.8
Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow
In Weintek's cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.
-
Medium 5.9
Directus crashes on invalid WebSocket message
Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this …
-
Low 2.7
Disclosure of user names via admin bulk action views in wagtail
Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules p…
-
Medium 6.5CVE-2023-45826 Scanner template
Authenticated SQL Injection in leantime
Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injectio…
-
Medium 5.5
Token in custom credentials object can leak through logs in ydb-go-sdk
ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object (implementation of interface Credentials it may leak into logs. This happens because this object could be serialized i…
-
Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in DEXMA DEXGate
The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnerability, which may allow an attacker to create malicious requests for obtaining the information of the version about the web server used.
-
Medium 5.5
Cross-Site Request Forgery in DEXMA DEXGate
The affected product is vulnerable to a cross-site request forgery vulnerability, which may allow an attacker to perform actions with the permissions of a victim user.
-
High 8.0
Improper Authentication in DEXMA DEXGate
The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to impersonate a legitimate user as long as the device keeps the session active, since the attack takes advantage of the cookie header to generate "leg…
-
Medium 6.3
Cleartext Transmission of Sensitive Information in DEXMA DEXGate
The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker with access to the network, where clients have access to the DexGate server, could capture traffic. The attacker can later us th…
-
Medium 5.4
Cross-site Scripting in DEXMA DEXGate
The affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary Java Script by injecting an XSS payload into the 'hostname' parameter of the vulnerable software.
-
High 7.8
Santesoft Sante DICOM Viewer Pro Stack-based Buffer Overflow
Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to a stack-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
-
High 7.8
Santesoft Sante DICOM Viewer Pro Out-of-bounds Write
Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
-
High 7.8
Santesoft Sante FFT Imaging Out-of-bounds Read
Santesoft Sante FFT Imaging lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
-
High 7.8
A use-after-free vulnerability exists in the Figure stream parsing functionality of Ichitaro 2023 1.0.1.59372. A specia…
-
High 7.8
An integer overflow exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted docu…
-
High 7.8
An out-of-bounds write vulnerability exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A speci…
-
High 7.8
An out-of-bounds write vulnerability exists within the parsers for both the "DocumentViewStyles" and "DocumentEditStyle…
-
Medium 6.5
React Developer Tools extension Improper Authorization vulnerability
The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived f…
-
High 7.8
SolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation Vulnerability
The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation.
-
High 8.8
SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability allows an unauthenticated user to achieve the Remote Code Execution.
-
Medium 6.8
SolarWinds Access Rights Manager OpenFile Directory Traversal Remote Code Execution Vulnerability
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges.
-
High 7.8
SolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation Vulnerability
The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resources to Privilege Escalation.
-
High 8.0CVE-2023-35180 EPSS 29%
SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds ARM API.