Archive
12 December 2023
Vulnerabilities first published on this day (UTC), newest first.
192 results · Feed
-
High 7.5
Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability
Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability
-
High 7.5
Microsoft Defender Denial of Service Vulnerability
Microsoft Defender Denial of Service Vulnerability
-
Medium 5.3
DHCP Server Service Information Disclosure Vulnerability
DHCP Server Service Information Disclosure Vulnerability
-
Critical 9.6CVE-2023-36019 EPSS 16%
Microsoft Power Platform Connector Spoofing Vulnerability
Microsoft Power Platform Connector Spoofing Vulnerability
-
Medium 4.7
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability
-
High 7.8
Windows Media Remote Code Execution Vulnerability
Windows Media Remote Code Execution Vulnerability
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
-
High 7.6
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
-
Medium 5.5
Microsoft Word Information Disclosure Vulnerability
Microsoft Word Information Disclosure Vulnerability
-
High 7.8
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
-
High 7.8
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
-
Medium 4.1
A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepow…
-
Medium 6.8
Enterprise Search Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the…
-
Medium 4.3
Umbraco contains a DOM-XSS
Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Version…
-
Medium 4.3
Umbraco CMS Backoffice User can bypass "Publish" restriction
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8…
-
Low 3.5
Umbraco CMS vulnerable to possible injection of HTML in an unintended form
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versi…
-
Unscored —
The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both…
-
Unscored —
Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker th…
-
Medium 5.3
Unbounded queuing of path validation messages in cloudflare-quiche
quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation (RFC 9000 Section 8.2) requires that the recipient of a PATH_CHALLENGE f…
-
High 7.2
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGED…
-
High 7.2
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCO…
-
Medium 6.8
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected software does not correct…
-
Low 2.7
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The REST API of affected devices d…
-
Low 2.7
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The Web UI of affected devices doe…
-
High 7.2
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The radius configuration mechanism…
-
High 8.1
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly …
-
High 7.5
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All vers…
-
High 7.5
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All vers…
-
High 7.5
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All vers…
-
High 7.1
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All vers…
-
High 7.1
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All vers…
-
High 7.5
Affected devices improperly handle specially crafted packets sent to port 102/tcp. This could allow an attacker to crea…
-
High 7.5
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC C…
-
High 7.5
A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All vers…
-
High 7.5
A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All vers…
-
Medium 4.2
A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). An information disclosure vuln…
-
Low 3.1
Leak Inaccessible Playbook Information via Channel Action IDOR
Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in …
-
High 7.6
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions >= V8.3), LOGO! 12/24RCEo (6ED…
-
Medium 6.1
Stackrox: missing http security headers allows for clickjacking in web ui
In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attac…
-
Medium 6.3
Reflected Cross-Site Scripting in SAS 9.4
SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do` endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authe…