11584 matches found
CBL Mariner 2.0 Security Update: cmake / curl / mysql / rust / tensorflow (CVE-2023-27536)
The version of cmake / curl / mysql / rust / tensorflow installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-27536 advisory. - An authentication bypass vulnerability exists libcurl 8.0.0 in the...
CBL Mariner 2.0 Security Update: kernel (CVE-2023-1513)
The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-1513 advisory. - A flaw was found in KVM. When calling the KVMGETDEBUGREGS ioctl, on 32-bit systems, there might be some...
CBL Mariner 2.0 Security Update: application-gateway-kubernetes-ingress / golang / kubevirt / skopeo / telegraf (CVE-2022-41723)
The version of application-gateway-kubernetes-ingress / golang / kubevirt / skopeo / telegraf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-41723 advisory. - A maliciously crafted HTTP/2 stream...
CBL Mariner 2.0 Security Update: kernel (CVE-2023-1079)
The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-1079 advisory. - A flaw was found in the Linux kernel. A use-after-free May be triggered in asuskbdbacklightset when...
EC-CUBE plugin "NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series)" vulnerable to authentication bypass
Overview EC-CUBE plugin "NEXT ENGINE Integration Plugin for EC-CUBE 2.0 series" provided by NE Inc. contains an authentication bypass vulnerability CWE-287. TSUKADA Nobuhisa of Seasoft reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...
WordPress UserPlus Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Software UserPlus Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0824 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 16e46e951741 Credits Shreya Pohekar Required privilege...
Fedora: Security Advisory for mediawiki (FEDORA-2023-9d6ab5ebf2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
MP4v2 缓冲区错误漏洞
MP4v2 is a library for creating, modifying, and reading MP4 files by enzo1982 individual developers. A security vulnerability exists in MP4v2 version v2.0.0, which stems from the discovery of a heap buffer overflow vulnerability contained in the MP4GetVideoProfileLevel function via /src/mp4.cpp...
MyBB 跨站脚本漏洞
MyBB MyBulletinBoard is a free and web-based forum software developed by MYBB team using PHP and MySQL. The software is easy to use, supports multiple languages, scalable and so on. A security vulnerability exists in MyBB Export User plugin version 2.0 and prior versions, which stems from a...
EulerOS 2.0 SP8 : lxc (EulerOS-SA-2023-1600)
According to the versions of the lxc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected...
EulerOS 2.0 SP8 : python-wheel (EulerOS-SA-2023-1608)
According to the versions of the python-wheel package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue discovered in Python Packaging Authority PyPA Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via...
EulerOS 2.0 SP8 : pkgconf (EulerOS-SA-2023-1604)
According to the versions of the pkgconf packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in...
EulerOS 2.0 SP8 : libtiff (EulerOS-SA-2023-1599)
According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file...
UserPlus <= 2.0 - Stored XSS via CSRF
The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack. Open the .html file where the admin user is logged in history.pushState'', '', '/' input type="hi...
EulerOS 2.0 SP8 : docker-engine (EulerOS-SA-2023-1617)
According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfslinux.go. To exploi...
EulerOS 2.0 SP8 : sudo (EulerOS-SA-2023-1611)
According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user- provided environment variables SUDOEDITOR,...
h2 vulnerable to denial of service
Hyper is an HTTP library for Rust and h2 is an HTTP 2.0 client & server implementation for Rust. An issue was discovered in h2 v0.2.4 when processing header frames. It incorrectly processes the HTTP2 RSTSTREAM frames by not always releasing the memory immediately upon receiving the reset frame,...
Authorization
SAP HCM Fiori App My Forms Fiori 2.0 - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header data...
CVE-2023-1903
CVE-2023-1903 affects SAP HCM Fiori App My Forms (Fiori 2.0) version 605. The underlying issue is missing authorization checks for an authenticated user, which can expose restricted header data. Sources consistently describe the affected software and the root cause as a lack of proper access cont...
