Archive
12 December 2023
Vulnerabilities first published on this day (UTC), newest first.
65 results · Clear filters · Feed
-
High 8.5
Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')
Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.
-
High 7.1
Ansible: template injection
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection …
-
High 7.5
Undertow: ajp request closes connection exceeding maxrequestsize
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP respons…
-
High 8.3CVE-2023-50252 EPSS 24%
php-svg-lib unsafe attributes merge when parsing `use` tag
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when the `href` attr…
-
High 8.9
Laf env causes sensitive information disclosure
Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, i…
-
High 7.7
Umbraco CMS possible path traversal when creating packages from backoffice
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location.…
-
High 7.3
Azure Connected Machine Agent Elevation of Privilege Vulnerability
Azure Connected Machine Agent Elevation of Privilege Vulnerability
-
High 7.5
Windows DNS Spoofing Vulnerability
Windows DNS Spoofing Vulnerability
-
High 7.5
Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 8.0
Windows Bluetooth Driver Remote Code Execution Vulnerability
Windows Bluetooth Driver Remote Code Execution Vulnerability
-
High 7.8
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
-
High 8.8
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
-
High 7.8
Windows Sysmain Service Elevation of Privilege Vulnerability
Windows Sysmain Service Elevation of Privilege Vulnerability
-
High 8.1CVE-2023-35628 EPSS 93%
Windows MSHTML Platform Remote Code Execution Vulnerability
Windows MSHTML Platform Remote Code Execution Vulnerability
-
High 7.5
DHCP Server Service Information Disclosure Vulnerability
DHCP Server Service Information Disclosure Vulnerability
-
High 8.8
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
-
High 7.5
DHCP Server Service Denial of Service Vulnerability
DHCP Server Service Denial of Service Vulnerability
-
High 8.8
Microsoft ODBC Driver Remote Code Execution Vulnerability
Microsoft ODBC Driver Remote Code Execution Vulnerability
-
High 7.5CVE-2023-36005 EPSS 24%
Windows Telephony Server Elevation of Privilege Vulnerability
Windows Telephony Server Elevation of Privilege Vulnerability
-
High 8.8
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
-
High 7.5
Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability
Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability
-
High 7.5
Microsoft Defender Denial of Service Vulnerability
Microsoft Defender Denial of Service Vulnerability
-
High 7.8
Windows Media Remote Code Execution Vulnerability
Windows Media Remote Code Execution Vulnerability
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
-
High 7.6
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
-
High 7.8
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
-
High 7.8
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
-
High 7.2
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGED…
-
High 7.2
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCO…
-
High 7.2
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The radius configuration mechanism…
-
High 8.1
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly …
-
High 7.5
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All vers…
-
High 7.5
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All vers…
-
High 7.5
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All vers…
-
High 7.1
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All vers…
-
High 7.1
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All vers…
-
High 7.5
Affected devices improperly handle specially crafted packets sent to port 102/tcp. This could allow an attacker to crea…
-
High 7.5
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC C…