Archive
1 December 2023
Vulnerabilities first published on this day (UTC), newest first.
11 results · Clear filters · Feed
-
High 7.1
Unescaped passing of the request URL in Collabora Online
Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with Collabora Online Built-in CODE Server app can be vulnerable to attack via proxy.php. This vulnerability has been fixed in Collabora Online - Built…
-
High 7.5
IBM InfoSphere Information Server denial of service
IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161.
-
High 8.3
Reflected Cross-site Scripting Vulnerability in dpaste
dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited …
-
High 7.5
Cookie leakage between different users in fastapi-proxy-lib
### Impact In the implementation of version `0.0.1`, requests from different user clients are processed using a shared `httpx.AsyncClient`. However, one oversight is that the `httpx.AsyncClient` will persistently store cookies based on the `set-cookie` respon…
-
High 8.4
IBM i information disclosure
IBM Administration Runtime Expert for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information caused by improper authority checks. IBM X-Force ID: 265266.
-
High 8.4
IBM AIX command execution
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 267966.
-
High 7.5
Plaintext Storage of a Password in ArslanSoft's Education Portal
Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Read Sensitive Strings Within an Executable. This issue affects Education Portal: before v1.1.
-
High 8.6
Cross-site Scripting (XSS) - Reflected in viliusle/minipaint
Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0.
-
High 7.5
User Enumeration in ArslanSoft's Education Portal
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting. This issue affects Education Portal: before v1.1.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU processing operations to gain access to already fr…
-
High 8.7
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.