107,324 results · Clear filters · Feed
-
Medium 5.3
Apache log4net: NUL character truncates EventLogAppender records
Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception …
-
Medium 4.7
Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitt…
-
Medium 5.9
Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning
Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issu…
-
Medium 6.5
Security Advisory 0194
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the…
-
Medium 6.5
Security Advisory 0194
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low…
-
Medium 6.8
Security Advisory 0191
Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.
-
Medium 6.5
Security Advisory 0190
Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability.
-
Medium 5.9
Security Advisory 0190
An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data.
-
Medium 4.3
Security Advisory 0187
Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication process.
-
Medium 4.1
Security Advisory 0186
Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
-
Medium 4.1
Security Advisory 0186
Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
-
Medium 6.3
Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions
A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then w…
-
Medium 6.8
Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same…
-
Medium 5.3
Sssd: sssd: information disclosure via query injection in entra id lookups
A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulat…
-
Medium 6.5
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontro…
-
Medium 6.5
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggr…
-
Medium 6.5
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of…
-
Medium 6.2
Uncaught Exception in Elastic Endpoint Leading to Denial of Service
Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, a…
-
Medium 6.5
Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive crede…
-
Medium 6.5
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, …
-
Medium 4.3
Missing Authorization in Kibana Leading to Information Disclosure
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization che…
-
Medium 6.5
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
-
Medium 4.3
Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressio…
-
Medium 5.4
Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the …
-
Medium 6.5
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query proce…
-
Medium 4.3
Gitea private repository access retained after rejected transfer
When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named re…
-
Medium 4.3
Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS
With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as `169.254.169.254`, even when `ALLOW_LOCALNETWORKS = false`. The local-netw…
-
Medium 6.5
Gitea issue reference parsing CPU exhaustion
When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment…
-
Medium 5.5
Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This co…
-
Medium 5.4
Gitea container registry stored XSS through blob media type
Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or restrictive content security policy. A user who can push container images can publish a blo…
-
Medium 4.3
Gitea migration and pull mirror SSRF through multi-answer DNS
Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create…
-
Medium 5.3
Authentication Bypass in the API Interface Allows Unauthorized Information Disclosure in ClearPass Policy Manager
A vulnerability in an API interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to obtain sensitive information from the affected sy…
-
Medium 5.5
Local Disclosure of Sensitive Information in HPE Networking ClearPass Policy Manager Client Software
A sensitive information disclosure vulnerability exists in the client software of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an attacker with local access to the affected system to obtain sensitive information.
-
Medium 6.5
Authenticated Command Injection Vulnerability in the ClearPass Policy Manager OnGuard Agent
A command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary commands. Successful exploitation could allow an attacker to execute commands with elevated privileges on the a…
-
Medium 5.4
Unauthenticated DOM-Based Cross-Site Scripting (XSS) Vulnerability in the ClearPass Policy Manager Client Interface
A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting (XSS) attack against a user of the affected client interface. Successful exploitation c…
-
Medium 6.7
Local Arbitrary File Write Leading to Local Privilege Escalation in ClearPass Policy Manager OnGuard Agent
An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if certain preconditions outside of the attacker's control are met. Successful exploitation co…
-
Medium 6.7
Local Privilege Escalation in ClearPass Client Software
A local privilege escalation vulnerability exists in the ClearPass client software. Successful exploitation could allow a low-privileged local user to execute commands with elevated privileges on the affected system, if certain conditions outside of the attac…
-
Medium 6.1
Authenticated Local Denial-of-Service Vulnerability in the OnGuard Agent of ClearPass Policy Manager
A denial of service vulnerability exists in the OnGuard agent of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an authenticated local attacker to interrupt the normal operation of the agent service.
-
Medium 6.5
Unauthenticated Sensitive Information Disclosure in AOS-S
A sensitive information disclosure vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated remote attacker to access sensitive information.
-
Medium 6.5
Authenticated Buffer Overflow Vulnerabilities lead to Denial-of-Service in AOS-S
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an authenticated remote attacker to cause a denial-of-service condition on the affected system.