2207 matches found
CVE-2023-26812
DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-26813. Reason: This record is a reservation duplicate of CVE-2023-26813. Notes: All CVE users should reference CVE-2023-26813 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...
CVE-2017-9088
Affected software: Flask and Werkzeug. Root cause: Directory traversal due to an inadequate filter in the Windows-specific path handling inside safe_join. Impact: Potential disclosure of arbitrary files from a server. Evidence: Veracode summary describes directory traversal vulnerability in Flask...
CVE-2014-1866
The connected VERACODE entry documents a vulnerability in fat_free_crm: Information leakage via error pages. The root cause is that consider_all_requests_local is set to true by default in production, causing 404 and 500 error pages to expose server setup information. The document does not provid...
CVE-2015-3507
The connected VERACODE entry documents a memory-leak DoS in OpenSSL caused by a zero-length DTLS fragment. It confirms OpenSSL is vulnerable to DoS via memory exhaustion, but the provided materials do not specify affected versions, exact root-cause code paths, or remediation steps. No exploit det...
CVE-2016-9971
The connected OSV/Veracode references indicate a CSRF vulnerability in Jupyter Notebook related to CSRF token checks and authorization header handling. Affected package is jupyter-notebook (notably 6.2.0-1.4 on openSUSE Tumbleweed per the OSV entry), with the Veracode entry noting possible creati...
CVE-2017-15689
Technical details for CVE-2017-15689 are not provided in the supplied documents. No information on affected products, root cause, or remediation is available here; monitor for updates.
CVE-2018-9863
The CVE-2018-9863 entry concerns the express-useragent Node.js/ExpressJS middleware. The connected documents reveal a concrete vulnerability: lack of sanitization/escaping of the HTTP User-Agent header , which an attacker can exploit to trigger Cross-site Scripting (XSS) . Impact described across...
CVE-2018-14178
The connected Veracode entry reports a practical vulnerability in the snapd project (github.com/snapcore/snapd) describing an access restriction bypass. Specifically, when the snap logs command is invoked via a call to journalctl, match arguments are not applied, allowing attackers to bypass syst...
CVE-2018-18902
Grafana (singlestat panel) is vulnerable to cross-site scripting (XSS) because the prefix and postfix fields are not properly sanitized, allowing an attacker to inject and execute arbitrary JavaScript in a victim’s browser. The connected Veracode entry confirms the XSS issue but provides no explo...
CVE-2018-7646
The connected Veracode entry identifies a denial of service in svgexport caused by a missing timeout when loading an external image. Impact is DoS; no exploit details are provided in the supplied documents. No CVE-specific remediation is stated here; monitor for updates.
CVE-2018-19454
The connected document identifies a concrete vulnerability in yiisoft/yii2: information disclosure caused by credentials (e.g., HTTP auth username/password) being logged in the application’s logging target (\yii\log\Target). An attacker who can access the log files could retrieve these credential...
CVE-2019-11075
This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...
CVE-2019-11075
HashiCorp Vault is vulnerable to information disclosure via an in-memory cache on performance standby nodes not being purged when a mount filter excludes the secondary cluster. The result is exposure of mount configuration data that can lead to token or lease issuance. The available connected doc...
CVE-2019-17196
The connected Veracode entry (VERACODE:20781) identifies a concrete vulnerability in Apache Kafka described as a Validation Bypass. An authenticated attacker with Write Permission can craft a Produce Request that bypasses ACL validation, enabling potential data integrity impact. This CVE’s public...
CVE-2018-20142
CVE-2018-20142 (reserved CVE) | Affected component: the sharrre library. Vulnerability: Cross-site scripting (XSS) vulnerability in which a remote attacker can inject arbitrary JavaScript into a victim’s browser via the location hash. Impact (as described): attacker could steal session tokens or ...
CVE-2017-11859
Technical details for CVE-2017-11859 are not publicly available in the provided documents. Monitor for updates; no affected products, root cause, or remediation information is disclosed here.
CVE-2023-20099
Technical details for CVE-2023-20099 are not publicly available in the provided documents. Monitor for updates and the release of concrete information on affected products, impact, and remediation.
CVE-2023-23655
CVE-2023-23655 relates to the WordPress plugin MainWP Code Snippets Extension (< =4.0.2). The vulnerability is due to Broken Access Control: there is no authorization check when updating plugin settings, which could let any authenticated user (e.g., a subscriber) modify settings. Affected vers...
UBUNTU-CVE-2023-27655
REJECT DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2019-9587. Reason: This record is a reservation duplicate of CVE-2019-9587. Notes: All CVE users should reference CVE-2019-9587 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...