Archive
21 November 2023
Vulnerabilities first published on this day (UTC), newest first.
62 results · Feed
-
High 7.5
Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" f…
-
Medium 5.7
Clear Text Credentials Exposed via Onboarding Task
The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credential…
-
High 8.4
fastbots Eval Injection vulnerability
fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could modify the locators.ini locator file with python code that without proper validation it's executed and …
-
Low 3.5
Nextcloud Mail app vulnerable to Server-Side Request Forgery
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versio…
-
Medium 5.0
Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, …
-
Medium 4.2
Nextcloud Server user_ldap app logs user passwords in the log file on level debug
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, when the log level was set to debug, the use…
-
Medium —
Decryption of malicious PBES2 JWE objects can consume unbounded system resources
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-servic…
-
Medium 4.3
Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, …
-
Low 2.4
Nextcloud Server admins can change authentication details of user configured external storage
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of …
-
Low 3.5
Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTM…
-
Critical 10.0
Data leakage and arbitrary remote code execution in Syrus cloud devices
The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service. The MQTT server also leaks the location, video…
-
Low 3.5
Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles …
-
High 8.5
Nextcloud Server users can make external storage mount points inaccessible for other users
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0.14.16, 21.0.9.13, 2…
-
Medium 5.3
TorchServe ZipSlip
TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are e…
-
Medium 5.9
Cap'n Proto WebSocket message can cause crash
Cap'n Proto is a data interchange format and capability-based RPC system. In versions 1.0 and 1.0.1, when using the KJ HTTP library with WebSocket compression enabled, a buffer underrun can be caused by a remote peer. The underrun always writes a constant val…
-
High 7.5
OAuth2: PKCE can be fully circumvented
authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the single sign-on provider (authentik) must check if there is a matching and existing `code_verifier` during the …
-
Medium 6.7
Kernel: nvme: memory corruption via unprivileged user passthrough
A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated ker…
-
Medium 6.5
OpenReplay HTML Injection vulnerability
OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors ca…
-
Low 3.1CVE-2023-47643 Scanner template
SuiteCRM has Unauthenticated Graphql Introspection Enabled
SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the Gra…
-
Medium 6.3
A vulnerability in the installer script of Cisco AppDynamics PHP Agent could allow an authenticated, local attacker to …
-
Medium 6.7
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, r…
-
Medium 4.8
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to con…
-
Medium 5.5
A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated…
-
High 7.8
Siemens Solid Edge, JT2Go, and Teamcenter Visualization Improper Restriction of Operations within the Bounds of a Memory Buffer
The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code in the context of the current process.
-
High 8.3
L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req()
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.
-
High 8.5
This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2…
-
High 8.0
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and S…
-
High 7.4
Texas Instruments FREERTOS Integer Overflow or Wraparound
Texas Instruments devices running FREERTOS, malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'malloc' for FreeRTOS, resulting in code execution.
-
High 7.4
Texas Instruments TI-RTOS Integer Overflow or Wraparound
Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.
-
Unscored —
Memory safety bugs present in Firefox 119. Some of these bugs showed evidence of memory corruption and we presume that …
-
Unscored —
An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnera…
-
Unscored —
An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referre…
-
Unscored —
Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence…
-
Unscored —
When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockabl…
-
Unscored —
If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacke…
-
Unscored —
When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a …
-
Unscored —
Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could b…
-
Unscored —
Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefo…
-
Unscored —
The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission pro…
-
Unscored —
On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak …