Tuesday, July 2, 2024 Security Releases
Summary The Node.js project will release new versions of the 22.x, 20.x, 18.x releases lines on or shortly after, Tuesday, July 2, 2024 in order to address: 1 high severity issues. 2 medium severity issues. 3 low severity issues. Node.js fetch will be upgraded to undici v6.19.2 on Node.js 18.x...
7AI Score
CVE-2023-50964 IBM InfoSphere Information Server cross-site scripting
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...
5.4CVSS
7AI Score
EPSS
CVE-2023-50964 IBM InfoSphere Information Server cross-site scripting
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...
5.4CVSS
EPSS
CVE-2024-28794 IBM InfoSphere Information Server cross-site scripting
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...
5.4CVSS
7AI Score
EPSS
CVE-2024-28794 IBM InfoSphere Information Server cross-site scripting
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...
5.4CVSS
EPSS
CVE-2023-50953 IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. IBM X-Force ID: ...
5.4CVSS
EPSS
CVE-2023-50953 IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. IBM X-Force ID: ...
5.4CVSS
5.8AI Score
EPSS
CVE-2024-28797 IBM InfoSphere Information Server cross-site scripting
IBM InfoSphere Information Server 11.7 is vulnerable stored to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...
6.4CVSS
EPSS
CVE-2024-28797 IBM InfoSphere Information Server cross-site scripting
IBM InfoSphere Information Server 11.7 is vulnerable stored to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...
6.4CVSS
5.8AI Score
EPSS
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. IBM X-Force ID: ...
5.3CVSS
EPSS
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. IBM X-Force ID: ...
5.3CVSS
4.9AI Score
EPSS
IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...
7.2CVSS
EPSS
IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...
7.2CVSS
6.2AI Score
EPSS
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: ...
4.3CVSS
EPSS
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: ...
4.3CVSS
4.7AI Score
EPSS
9.8CVSS
9.6AI Score
0.038EPSS
maxlab.co.in Cross Site Scripting vulnerability OBB-3939784
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...
6.2AI Score
CVE-2024-31902 IBM InfoSphere Information Server cross-site request forgery
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: ...
4.3CVSS
EPSS
CVE-2024-35119 IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. IBM X-Force ID: ...
5.3CVSS
EPSS
A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a.....
5.3CVSS
EPSS
A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a.....
5.3CVSS
5.9AI Score
EPSS
IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: ...
4CVSS
6.1AI Score
EPSS
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...
5.4CVSS
6AI Score
EPSS
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...
5.4CVSS
EPSS
IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: ...
4CVSS
EPSS
CVE-2024-28798 IBM InfoSphere Information Server cross-site scripting
IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...
7.2CVSS
EPSS
CVE-2023-35022 IBM InfoSphere Information Server improper authentication
IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: ...
4CVSS
EPSS
CVE-2024-28795 IBM InfoSphere Information Server cross-site scripting
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...
5.4CVSS
EPSS
unesen.ca Cross Site Scripting vulnerability OBB-3939783
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...
6.2AI Score
CVE-2024-21626 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller, k3s, kubescape, wolfictl, zot, docker, nvidia-device-plugin, nerdctl, telegraf, datadog-agent, ctop, k3d, cadvisor, buildkitd, syft, trivy, skopeo, zarf, grype, skaffold, newrelic-infrastructure-agent, runc, kubernetes, kots, k9s,...
8.6CVSS
9.2AI Score
0.051EPSS
CVE-2023-45289 vulnerabilities
Vulnerabilities for packages: litefs, tigera-operator, kubernetes-dashboard-metrics-scraper, chartmuseum, caddy, dex, aws-ebs-csi-driver, kustomize, nri-apache, loki, vexctl, gatekeeper, speedtest-go, cortex, slsa-verifier, yam, cri-tools, nri-discovery-kubernetes, argo-cd, nri-memcached,...
7.8AI Score
0.0004EPSS
GHSA-VVPX-J8F3-3W6H vulnerabilities
Vulnerabilities for packages: grpcurl, wireguard-go, go, restic, dynamic-localpv-provisioner, gke-gcloud-auth-plugin, k3d, hey,...
7.5AI Score
GHSA-8R3F-844C-MC37 vulnerabilities
Vulnerabilities for packages: litefs, tigera-operator, kubernetes-dashboard-metrics-scraper, grafana-agent-operator, chartmuseum, caddy, dex, aws-ebs-csi-driver, oauth2-proxy, kustomize, loki, vexctl, aactl, gatekeeper, docker, cortex, slsa-verifier, cri-tools, nri-discovery-kubernetes,...
7.5AI Score
CVE-2023-44487 vulnerabilities
Vulnerabilities for packages: dex, dotnet, cilium-envoy, oauth2-proxy, tomcat, aactl, gatekeeper, nghttp2, cortex, slsa-verifier, git-lfs, argo-cd, goreleaser, gke-gcloud-auth-plugin, traefik, falco, spark-operator, cosign, nats, kubernetes-csi-node-driver-registrar, prometheus-blackbox-exporter,.....
7.5CVSS
9AI Score
0.732EPSS
CVE-2023-45288 vulnerabilities
Vulnerabilities for packages: tigera-operator, kubernetes-dashboard-metrics-scraper, chartmuseum, caddy, go, aactl, gatekeeper, cri-tools, flannel, istio-cni, nri-memcached, goreleaser, bazelisk, cloudflared, spark-operator, gptscript, configmap-reload, newrelic-infra-operator, containerd,...
6.8AI Score
0.0004EPSS
CVE-2024-24787 vulnerabilities
Vulnerabilities for packages: litefs, tigera-operator, kubernetes-dashboard-metrics-scraper, grafana-agent-operator, chartmuseum, caddy, go, hcloud, dex, aws-ebs-csi-driver, oauth2-proxy, kustomize, loki, aactl, go-fips, cortex, cri-tools, git-lfs, step, istio-operator, flannel, sonobuoy,...
6.5AI Score
0.0004EPSS
GHSA-5FQ7-4MXC-535H vulnerabilities
Vulnerabilities for packages: litefs, tigera-operator, kubernetes-dashboard-metrics-scraper, grafana-agent-operator, chartmuseum, caddy, go, hcloud, dex, aws-ebs-csi-driver, oauth2-proxy, kustomize, loki, aactl, go-fips, cortex, cri-tools, git-lfs, step, istio-operator, flannel, sonobuoy,...
7.5AI Score
CVE-2024-24789 vulnerabilities
Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, chartmuseum, caddy, go, aactl, gatekeeper, cri-tools, flannel, istio-cni, nri-memcached, bazelisk, local-static-provisioner, cloudflared, configmap-reload, newrelic-infra-operator, dagger, vcluster, go-md2man,...
5.5CVSS
6.1AI Score
0.0004EPSS
CVE-2023-45285 vulnerabilities
Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, gitlab-logger, docker-credential-ecr-login, grpcurl, gops, cilium-envoy, nsc, aws-flb-kinesis, go-bindata, flannel-cni-plugin, aactl, aws-flb-cloudwatch, sops, petname, cortex, slsa-verifier, docker-cli, nri-discovery-kubernetes,.....
7.5CVSS
7.9AI Score
0.001EPSS
Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, chartmuseum, dex, aws-ebs-csi-driver, oauth2-proxy, aactl, gatekeeper, git-lfs, argo-cd, goreleaser, gke-gcloud-auth-plugin, timoni, vault, spark-operator, cosign, kubernetes-csi-node-driver-registrar,...
6.1CVSS
7.3AI Score
0.001EPSS
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: litefs, tigera-operator, kubernetes-dashboard-metrics-scraper, grafana-agent-operator, chartmuseum, caddy, dex, aws-ebs-csi-driver, oauth2-proxy, kustomize, loki, vexctl, aactl, gatekeeper, docker, cortex, slsa-verifier, cri-tools, nri-discovery-kubernetes,...
6.6AI Score
0.0004EPSS
CVE-2024-24784 vulnerabilities
Vulnerabilities for packages: litefs, tigera-operator, kubernetes-dashboard-metrics-scraper, chartmuseum, caddy, dex, aws-ebs-csi-driver, kustomize, nri-apache, loki, vexctl, gatekeeper, speedtest-go, cortex, slsa-verifier, yam, cri-tools, nri-discovery-kubernetes, argo-cd, nri-memcached,...
7.8AI Score
0.0004EPSS
GHSA-RR6R-CFGF-GC6H vulnerabilities
Vulnerabilities for packages: litefs, tigera-operator, kubernetes-dashboard-metrics-scraper, chartmuseum, caddy, dex, aws-ebs-csi-driver, kustomize, nri-apache, loki, vexctl, gatekeeper, speedtest-go, cortex, slsa-verifier, yam, cri-tools, nri-discovery-kubernetes, argo-cd, nri-memcached,...
7.5AI Score
CVE-2024-35255 vulnerabilities
Vulnerabilities for packages: chezmoi, grafana-agent-operator, step-ca, gitlab-runner, kubescape, grafana-mimir, zot, py3-cassandra-medusa, loki, keda, sops, tekton-pipelines, harbor-registry, tempo, cortex, step, flux-kustomize-controller, argo-workflows, fluent-bit-plugin-loki, bank-vaults,...
5.5CVSS
6AI Score
0.0004EPSS
GHSA-M5VV-6R4H-3VJ9 vulnerabilities
Vulnerabilities for packages: chezmoi, grafana-agent-operator, step-ca, gitlab-runner, kubescape, grafana-mimir, zot, py3-cassandra-medusa, loki, keda, sops, tekton-pipelines, harbor-registry, tempo, cortex, step, flux-kustomize-controller, argo-workflows, fluent-bit-plugin-loki, bank-vaults,...
7.5AI Score
CVE-2022-41723 vulnerabilities
Vulnerabilities for packages: grpcurl, wireguard-go, go, restic, dynamic-localpv-provisioner, gke-gcloud-auth-plugin, k3d, hey,...
7.5CVSS
8.4AI Score
0.024EPSS
GHSA-4V7X-PQXF-CX7M vulnerabilities
Vulnerabilities for packages: tigera-operator, kubernetes-dashboard-metrics-scraper, chartmuseum, caddy, go, aactl, gatekeeper, cri-tools, flannel, istio-cni, nri-memcached, goreleaser, bazelisk, cloudflared, spark-operator, gptscript, configmap-reload, newrelic-infra-operator, containerd,...
7.5AI Score
GHSA-2JWV-JMQ4-4J3R vulnerabilities
Vulnerabilities for packages: litefs, tigera-operator, kubernetes-dashboard-metrics-scraper, grafana-agent-operator, chartmuseum, caddy, go, hcloud, dex, aws-ebs-csi-driver, oauth2-proxy, kustomize, loki, aactl, cortex, cri-tools, git-lfs, step, istio-operator, flannel, sonobuoy,...
7.5AI Score
CVE-2024-24790 vulnerabilities
Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, chartmuseum, caddy, go, aactl, gatekeeper, cri-tools, flannel, istio-cni, nri-memcached, bazelisk, local-static-provisioner, cloudflared, configmap-reload, newrelic-infra-operator, dagger, vcluster, go-md2man,...
9.8CVSS
9.8AI Score
0.001EPSS
CVE-2023-39325 vulnerabilities
Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, chartmuseum, caddy, go, dex, aws-ebs-csi-driver, oauth2-proxy, aactl, gatekeeper, slsa-verifier, git-lfs, istio-operator, istio-cni, argo-cd, goreleaser, gke-gcloud-auth-plugin, timoni, falco, vault, spark-operator, cosign, nats,.....
7.5CVSS
8.4AI Score
0.002EPSS