Archive
28 March 2024
Vulnerabilities first published on this day (UTC), newest first.
180 results · Feed
-
High 7.2
Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could po…
-
High 7.2
Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could po…
-
Medium 5.5
Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high p…
-
Medium 5.3
Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A re…
-
Medium 5.9
Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerabilit…
-
High 8.8
Pcp: exposure of the redis server backend allows remote command execution via pmproxy
A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pm…
-
High 7.3
Cockpit: command injection when deleting a sosreport with a crafted name
A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.
-
Medium 6.0
Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability…
-
Medium 6.0
Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability…
-
High 7.3
Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulne…
-
Medium 6.0
Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an improper privilege management vulnerability. A local…
-
High 7.9
Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an insertion of sensitive information into log file vul…
-
Medium 6.5
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, ma…
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.2…
-
High 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 17.2, iOS 17.2 and …
-
High 8.3CVE-2023-42931 Public exploit
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Mon…
-
High 8.6
A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.7.2, macOS Ventu…
-
Medium 5.5
An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Monterey 12.7.2, macOS V…
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Mo…
-
High 8.8
This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.2. Remote Login sess…
-
Medium 5.5
A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sonoma 14.…
-
Medium 5.5
A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macO…
-
High 7.0
A race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.7.2, macOS Ventur…
-
High 7.5
This issue was addressed with improved checks This issue is fixed in iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16…
-
High 7.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.6.3, macO…
-
Medium 4.1
In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing t…
-
Medium 5.9
In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector
-
Medium 4.6CVE-2024-31138 EPSS 75%
In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
-
Medium 6.8
In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration
-
High 7.4
In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter
-
Medium 6.5
In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users …
-
Medium 6.1
In JetBrains TeamCity before 2024.03 open redirect was possible on the login page
-
Medium 6.3
SourceCodester Simple Subscription Website manage_user.php sql injection
A vulnerability was found in SourceCodester Simple Subscription Website 1.0 and classified as critical. This issue affects some unknown processing of the file manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initi…
-
Medium 6.3
Netentsec NS-ASG Application Security Gateway listloginfo.php sql injection
A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. This vulnerability affects unknown code of the file /protocol/log/listloginfo.php. The manipulation leads to sql injection. The attack can be initi…
-
High 7.3
Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04
Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges…
-
Medium 6.3
Netentsec NS-ASG Application Security Gateway list_crl_conf sql injection
A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_crl_conf. The manipulation of the argument CRLId leads to sql injection. It is possible to …
-
Medium 6.3
Shanghai Brad Technology BladeX API export-user sql injection
A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0. Affected is an unknown function of the file /api/blade-user/export-user of the component API. The manipulation with the input updatexml(1,concat(0x3f,md5(123456),0…
-
Low 3.5
HCL BigFix Platform is susceptible to a Denial of Service attack
The console may experience a service interruption when processing file names with invalid characters.
-
Low 2.0
HCL BigFix Platform is susceptible to Cross Site Scripting (XSS) and/or Man in the Middle (MITM) attack
An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration.
-
Low 3.5
HCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF)
An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.