Archive
14 February 2024
Vulnerabilities first published on this day (UTC), newest first.
98 results · Clear filters · Feed
-
Medium 6.4
Dependency management path traversal in helm
Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the `Chart.yaml` file includes a relative path change, the chart would be saved outsid…
-
Medium 6.4
Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which…
-
Medium 6.4
Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which…
-
Medium 6.7
An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass …
-
Medium 6.7
An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker …
-
Medium 5.9
HTML Injection Vulnerability
An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Repository parameters, which could lead to HTML redirection attacks.
-
Medium 5.3CVE-2024-25617 EPSS 88%
Denial of Service in HTTP Header parser in squid proxy
Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or…
-
Medium 4.2
External OpenID Connect Account Takeover by E-Mail Change in mastodon
Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML, OIDC) to attach to existing local users with the same e-mail address. This results in a possible ac…
-
Medium 4.3
PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication
A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of an authenticated Captive Portal user’s browser) if a user clicks on a malicio…
-
Medium 4.3
PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Portal
A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of a user’s browser) if a user clicks on a malicious link, allowing phishi…
-
Medium 6.3
PAN-OS: Improper IP Address Verification in GlobalProtect Gateway
An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.
-
Medium 6.6
PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.
-
Medium 6.8
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface on Panorama appliances. This enables the impersonation of another…
-
Medium 6.2
F5OS vulnerability
When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 5.5
F5OS QKView utility vulnerability
A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read files outside the QKView directory. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 6.0
BIG-IP Appliance mode iAppsLX vulnerability
When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX templates on a BIG-IP system. Note: Software versions which have reached End of Technical Support (E…
-
Medium 6.7
BIG-IP and BIG-IQ secure copy vulnerability
BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbitrary commands with a specially crafted command string. This vulnerability is du…
-
Medium 5.0
SSRF in CSV Datasource Plugin
Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this pl…
-
Medium 5.3
IBM Jazz for Service Management information disclosure
IBM Jazz for Service Management 1.1.3.20 could allow an unauthorized user to obtain sensitive file information using forced browsing due to improper access controls. IBM X-Force ID: 269929.
-
Medium 6.7
Uncontrolled search path element in some Intel(R) SSU software before version 3.0.0.2 may allow an authenticated user t…
-
Medium 6.7
Uncontrolled search path for some Intel(R) MPI Library Software before version 2021.11 may allow an authenticated user …
-
Medium 6.7
Uncontrolled search path in the Intel(R) SUR for Gameplay Software before version 2.0.1901 may allow a privillaged user…
-
Medium 6.7
Incorrect default permissions in the Intel(R) SUR for Gameplay Software before version 2.0.1901 may allow privillaged u…
-
Medium 4.9
Uncontrolled resource consumption for some Intel(R) SPS firmware before version SPS_E5_06.01.04.002.0 may allow a privi…
-
Medium 6.5
Out-of-bounds read in some Intel(R) QAT software drivers for Windows before version QAT1.7-W-1.11.0 may allow an authen…
-
Medium 6.7
Insecure inherited permissions in some Intel(R) Ethernet tools and driver install software may allow an authenticated u…
-
Medium 6.7
Uncontrolled search path in some Intel(R) ISPC software before version 1.21.0 may allow an authenticated user to potent…
-
Medium 6.7
Improper access control element in some Intel(R) Ethernet tools and driver install software, before versions 28.2, may …
-
Medium 6.7
Uncontrolled search path in some Intel(R) SDK for OpenCL(TM) Applications software may allow an authenticated user to p…
-
Medium 6.0
Improper buffer restrictions the Intel(R) C++ Compiler Classic before version 2021.8 for Intel(R) oneAPI Toolkits befor…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Battery Life Diagnostic Tool software before version 2.3.1 may allow an authe…
-
Medium 6.6
Improper access control in some Intel Unite(R) Client software before version 4.2.35041 may allow an authenticated user…
-
Medium 6.7
Uncontrolled search path in Intel(R) QSFP+ Configuration Utility software, all versions, may allow an authenticated use…
-
Medium 6.7
Uncontrolled search path in some Intel(R) Binary Configuration Tool software before version 3.4.4 may allow an authenti…
-
Medium 5.5
Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potenti…
-
Medium 6.3
Improper access control in some Intel(R) DSA software before version 23.4.33 may allow a privileged user to potentially…
-
Medium 5.0
Improper initialization in some Intel(R) MAS software before version 2.3 may allow an authenticated user to potentially…
-
Medium 6.7
Uncontrolled search path in some Intel(R) CIP software before version 2.4.10577 may allow an authenticated user to pote…
-
Medium 6.7
Improper authorization in some Intel(R) PM software may allow a privileged user to potentially enable escalation of pri…
-
Medium 5.0
Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.2 may allo…