Archive
12 December 2023
Vulnerabilities first published on this day (UTC), newest first.
54 results · Clear filters · Feed
-
Medium 5.4CVE-2023-6710 Public exploit
Mod_cluster/mod_proxy_cluster: stored cross site scripting
A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter…
-
Medium 5.3
php-svg-lib possible DoS caused by infinite recursion when parsing SVG document
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration an…
-
Medium 6.1
h2o vulnerable to TLS session resumption misdirection
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious b…
-
Medium 5.3
Umbraco CMS brute force exploit can be used to collect valid usernames
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can be used to collect valid usernames. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this iss…
-
Medium 5.4
Umbraco CMS vulnerable to Privilege Escalation using Spoofing
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (Editor, etc.) are able to access some unintended endpoints. Versions 8.18.10, 10.8.1, and 12.3.4 con…
-
Medium 6.8
Elastic Agent Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event tha…
-
Medium 6.8
Beats Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the…
-
Medium 5.3
Microsoft Outlook for Mac Spoofing Vulnerability
Microsoft Outlook for Mac Spoofing Vulnerability
-
Medium 5.5
Windows Kernel Denial of Service Vulnerability
Windows Kernel Denial of Service Vulnerability
-
Medium 6.5
Microsoft Outlook Information Disclosure Vulnerability
Microsoft Outlook Information Disclosure Vulnerability
-
Medium 6.8
Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability
Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability
-
Medium 6.5
Internet Connection Sharing (ICS) Denial of Service Vulnerability
Internet Connection Sharing (ICS) Denial of Service Vulnerability
-
Medium 6.7CVE-2023-36003 Public exploit
XAML Diagnostics Elevation of Privilege Vulnerability
XAML Diagnostics Elevation of Privilege Vulnerability
-
Medium 5.3
DHCP Server Service Information Disclosure Vulnerability
DHCP Server Service Information Disclosure Vulnerability
-
Medium 4.7
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability
-
Medium 5.5
Microsoft Word Information Disclosure Vulnerability
Microsoft Word Information Disclosure Vulnerability
-
Medium 4.1
A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepow…
-
Medium 6.8
Enterprise Search Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the…
-
Medium 4.3
Umbraco contains a DOM-XSS
Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Version…
-
Medium 4.3
Umbraco CMS Backoffice User can bypass "Publish" restriction
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8…
-
Medium 5.3
Unbounded queuing of path validation messages in cloudflare-quiche
quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation (RFC 9000 Section 8.2) requires that the recipient of a PATH_CHALLENGE f…
-
Medium 6.8
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected software does not correct…
-
Medium 4.2
A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). An information disclosure vuln…
-
Medium 6.1
Stackrox: missing http security headers allows for clickjacking in web ui
In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attac…
-
Medium 6.3
Reflected Cross-Site Scripting in SAS 9.4
SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do` endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authe…
-
Medium 6.8
OS command injection vulnerability in WRC-X3000GSN v1.0.2, WRC-X3000GS v1.0.24 and earlier, and WRC-X3000GSA v1.0.24 an…
-
Medium 4.3
Playbook plugin crash via missing interface type assertion
Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog.
-
Medium 4.3
Todo plugin gets crashed and disabled by member
Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash. After a few repetitions, the plugin is disabled.
-
Medium 6.5
Inaccessible Post Information Leak via Run Timeline IDOR
Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plugin allowing an attacker to get limited information about a post if they know the post ID
-
Medium 4.3
IDOR when updating the tasks of a private playbook run
Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID.
-
Medium 4.3
Playbook Plugin Crash via Run Checklist
Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks plugin
-
Medium 6.4
A Huawei data communication product has a command injection vulnerability. Successful exploitation of this vulnerabilit…
-
Medium 4.8
An improper access control vulnerability exists in a Huawei datacom product. Attackers can exploit this vulnerability t…
-
Medium 5.0CVE-2023-5536 Public exploit
A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the …
-
Medium 5.3
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requ…
-
Medium 6.4
Command Injection vulnerability in SAP Solution Manager
SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network.
-
Medium 4.3
Client-Side Desynchronization vulnerability in SAP Fiori Launchpad
SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application.
-
Medium 4.1
SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By do…
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution)
The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can …
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct
An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This can result in the disclosure or modification of non-sensitive …