Archive
16 February 2024
Vulnerabilities first published on this day (UTC), newest first.
7 results · Clear filters · Feed
-
Low —
tuf's Metadata API: Targets.get_delegated_role() is missing input validation
The security of both a TUF client and repository implementations depend on the concept of trusted Metadata objects verifying the signatures over other Metadata that it delegates to. This verification process uses `Targets.get_delegated_role(delegated_role: st…
-
Low 3.9
Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advis…
-
Low 3.5
Cross-Site Scripting (XSS) via File Upload in Alf.io
Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be …
-
Low 3.3
Privilege Management for Windows < 24.1 Information Leak
Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues.
-
Low 3.3
In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. T…
-
Low 2.0
ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode whic…
-
Low 3.3
In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a…