Archive
3 February 2024
Vulnerabilities first published on this day (UTC), newest first.
5 results · Clear filters · Feed
-
Low 3.5
SourceCodester CRUD without Page Reload fetch_data.php cross site scripting
A vulnerability was found in SourceCodester CRUD without Page Reload 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file fetch_data.php. The manipulation of the argument username/city leads to cross site scr…
-
Low —
Local File Inclusion vulnerability in zmarkdown
### Impact A minor Local File Inclusion vulnerability has been found in `zmarkdown`, which allowed for images with a known path on the host machine to be included inside a LaTeX document. To prevent it, a new option has been created that allow to replace inva…
-
Low —
Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only
### Vulnerability type Logging ### Detail etcd users who have no password can authenticate only through a client certificate. When such users try to authenticate into etcd using the Authenticate endpoint, errors are logged with insufficient information regard…
-
Low —
Etcd embed auto compaction retention negative value causing a compaction loop or a crash
### Impact Data Validation ### Detail The parseCompactionRetention function in embed/etcd.go allows the retention variable value to be negative and causes the node to execute the history compaction in a loop, taking more CPU than usual and spamming logs. ### …
-
Low —
Etcd pkg Insecure ciphers are allowed by default
### Vulnerability type Cryptography ### Detail The TLS ciphers list supported by etcd contains insecure cipher suites. Users can configure the desired ciphers using the “--cipher-suites” flag, and a default list of secure cipher suites is used if empty. ### W…