Archive
February 2024
Vulnerabilities first published in this month (UTC), newest first.
136 results · Clear filters · Feed
-
Low 3.5
Vulnerability of null references in the motor module.Successful exploitation of this vulnerability may affect availabil…
-
Low 2.2
Trusteer for mobile file upload
An undisclosed issue in Trusteer iOS SDK for mobile versions prior to 5.7 and Trusteer Android SDK for mobile versions prior to 5.7 may allow uploading of files. IBM X-Force ID: 238535.
-
Low 3.1
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). S…
-
Low 3.1
Vulnerability affecting the org.openjfx:javafx-media maven component of the OpenJFX project
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit v…
-
Low 2.6
Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected a…
-
Low 2.7
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure …
-
Low —
tuf's Metadata API: Targets.get_delegated_role() is missing input validation
The security of both a TUF client and repository implementations depend on the concept of trusted Metadata objects verifying the signatures over other Metadata that it delegates to. This verification process uses `Targets.get_delegated_role(delegated_role: st…
-
Low 3.9
Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advis…
-
Low 3.5
Cross-Site Scripting (XSS) via File Upload in Alf.io
Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be …
-
Low 3.3
Privilege Management for Windows < 24.1 Information Leak
Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues.
-
Low 3.3
In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. T…
-
Low 2.0
ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode whic…
-
Low 3.3
In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a…
-
Low 3.3
jail(2) information leak
The jail(2) system call has not limited a visiblity of allocated TTYs (the kern.ttys sysctl). This gives rise to an information leak about processes outside the current jail. Attacker can get information about TTYs allocated on the host or in other jails. Eff…
-
Low 3.1
Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon
Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by all…
-
Low 3.8
BIG-IP Advanced WAF and ASM Configuration utility vulnerability
An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
-
Low 3.8
Improper input validation in some Intel(R) SGX DCAP software for Windows before version 1.19.100.3 may allow an authent…
-
Low 1.8
Race condition in some Intel(R) MAS software before version 2.3 may allow a privileged user to potentially enable escal…
-
Low 2.0
Unchecked return value in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthen…
-
Low 3.8
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authent…
-
Low 2.5
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authent…
-
Low 3.8
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an au…
-
Low 3.8
Deserialization of untrusted data in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow …
-
Low 3.8
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an au…
-
Low 3.4
Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access t…
-
Low 3.3
Insufficient verification of data authenticity in the configuration state machine may allow a local attacker to potenti…
-
Low 3.3
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2…
-
Low 3.3
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2…
-
Low 3.3
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2…
-
Low 3.3
A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.251), Parasolid V35.1 (All versions < V35.…
-
Low 3.4
Opensc: memory use after free in authentic driver when updating token info
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system…
-
Low 3.5
dbartholomae lambda-middleware frameguard JSON Mime-Type JsonDeserializer.ts redos
A vulnerability, which was classified as problematic, has been found in dbartholomae lambda-middleware frameguard up to 1.0.4. Affected by this issue is some unknown functionality of the file packages/json-deserializer/src/JsonDeserializer.ts of the component…
-
Low 3.3
Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility. An authenti…
-
Low 2.7
Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error…
-
Low 3.1
KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal
A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. Th…
-
Low 3.9
HCL Sametime is impacted by a failure to invalidate sessions
Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.
-
Low 1.7
HCL Sametime is impacted by a sensitive information disclosure
Sametime is impacted by sensitive information passed in URL.
-
Low 2.4
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not sufficiently sanitized in the Edit Attributes page. A rogue administrator could put malicious code into…
-
Low 2.0
Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature
Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execu…
-
Low 2.0CVE-2024-1247 Public exploit
Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which mig…