Archive
12 December 2024
Vulnerabilities first published on this day (UTC), newest first.
109 results · Clear filters · Feed
-
Medium 5.9
Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service
Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw durin…
-
Medium 6.9
OpenTelemetry Logs source may lack authentication with some custom plugins
OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.…
-
Medium 6.9
Beego Vulnerable to Collision Hazards of MD5 in Cache Key Filenames
beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3…
-
Medium 6.8
Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx
SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issu…
-
Medium 6.5
Windows Defender Information Disclosure Vulnerability
Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose information over a network.
-
Medium 5.4
XWiki's scheduler in subwiki allows scheduling operations for any main wiki user
XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without an…
-
Medium 6.5
IBM InfoSphere Information Server denial of service
IBM InfoSphere Information Server 11.7 could allow an authenticated user to GUI to not load or stop working due to improper input validation.
-
Medium 4.4
SQL Injection
An authenticated attacker with the user/role "Poweruser" can perform an SQL injection by accessing the /class/template_io.php file and supplying malicious GET parameters. The "templates" parameter is vulnerable against blind boolean-based SQL injection attack…
-
Medium 5.9
Unauthenticated SQL Injection
An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters. The HTTP GET parameters search, table, field, and value are vulnerable. For example, one SQL injection can be performed…
-
Medium 5.5
Broken Access Control
An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session management. If two users access the web interface from the same IP they are logged in as the other user.
-
Medium 4.7
Reflected Cross Site Scripting
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parame…
-
Medium 4.7
Stored cross site scripting
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Power…
-
Medium 4.4
360 Javascript Viewer <= 1.7.29 - Authenticated (Administrator+) Stored Cross-Site Scripting
The 360 Javascript Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ref’ parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticat…
-
Medium 4.7
Stored cross site scripting
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Power…
-
Medium 4.7
Stored cross site scripting
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "File Name" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the "file name" an…
-
Medium 6.2
Concurrent variable access vulnerability in the ability module Impact: Successful exploitation of this vulnerability ma…
-
Medium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…
-
Medium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…
-
Medium 4.3
Out-of-bounds read vulnerability in the M3U8 module Impact: Successful exploitation of this vulnerability may cause fea…
-
Medium 4.3
Out-of-bounds read vulnerability in the DASH module Impact: Successful exploitation of this vulnerability will affect a…
-
Medium 4.4
Out-of-bounds access vulnerability in playback in the DASH module Impact: Successful exploitation of this vulnerability…
-
Medium 6.5
Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulne…
-
Medium 5.5
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…
-
Medium 5.7
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect…
-
Medium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…
-
Medium 6.5
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect…
-
Medium 6.5
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect…
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. Improper output encoding could lead to XSS if CSP is not enabled.
-
Medium 5.4
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled.
-
Medium 4.3
Allocation of Resources Without Limits or Throttling in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condit…
-
Medium 6.4
URL Redirection to Untrusted Site ('Open Redirect') in GitLab
An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potentially perform an open redirect against a given releases API endpoint.
-
Medium 5.1
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect…
-
Medium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…
-
Medium 6.1
Vulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may …
-
Medium 6.1
Race condition vulnerability in the DDR module Impact: Successful exploitation of this vulnerability may affect service…
-
Medium 6.2
Denial of service (DoS) vulnerability in the installation module Impact: Successful exploitation of this vulnerability …
-
Medium 6.7
Privilege Context Switching Error in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6.2. It may have been possible for an attacker with a victim's `CI_JOB_TOKEN` to obtain a GitLab sessi…
-
Medium 4.0
Insertion of Sensitive Information into Log File in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in Gr…
-
Medium 6.2
Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerabili…
-
Medium 6.7
File replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integr…