6143 matches found
PT-2023-23726
Name of the Vulnerable Software and Affected Versions Nextcloud server versions 24.0.0 through 24.0.10 Nextcloud server versions 25.0.0 through 25.0.4 Nextcloud server versions prior to 26.0.0 Description The issue is related to missing brute-force protection on the WebDAV endpoints via the basic...
SUSE-SU-2023:0821-1 Security update for grafana
This update for grafana fixes the following issues: - CVE-2022-23552: Fixed SVG processing by adding a dompurify preprocessor step bsc1207749. - CVE-2022-39324: Fixed originalUrl spoof security issue bsc1207750. - CVE-2022-41723: Fixed go issue to avoid quadratic complexity in HPACK decoding...
CVE-2023-28109: Authorization Bypass Through User-Controlled Key
Play With Docker is a browser-based Docker playground. Versions 0.0.2 and prior are vulnerable to domain hijacking. Because CORS configuration was not correct, an attacker could use play-with-docker.com as an example and set the origin header in an http request as evil-play-with-docker.com. The...
CVE-2021-44197: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in UBIT Information Technologies Student Information Management System. This issue affects Student Information Management System: before 20211126...
CVE-2021-44196: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in UBIT Information Technologies Student Information Management System. This issue affects Student Information Management System: before 20211126...
Experts Identify Fully-Featured Info Stealer and Trojan in Python Package on PyPI
A malicious Python package uploaded to the Python Package Index PyPI has been found to contain a fully-featured information stealer and remote access trojan. The package, named colourfool, was identified by Kroll's Cyber Threat Intelligence team, with the company calling the malware Colour-Blind...
Experts Identify Fully-Featured Info Stealer and Trojan in Python Package on PyPI
A malicious Python package uploaded to the Python Package Index PyPI has been found to contain a fully-featured information stealer and remote access trojan. The package, named colourfool , was identified by Kroll's Cyber Threat Intelligence team, with the company calling the malware Colour-Blind...
CVE-2023-25806
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the interna...
Authorization
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the interna...
CVE-2023-25806 Time discrepancy in authentication responses in OpenSearch
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the interna...
CVE-2023-25806 Time discrepancy in authentication responses in OpenSearch
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the interna...
CVE-2023-25806: Observable Timing Discrepancy
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the interna...
CVE-2023-24123
Jensen of Scandinavia Eagle 1200AC V15.03.06.33en was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet...
CVE-2023-24124
Jensen of Scandinavia Eagle 1200AC V15.03.06.33en was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet...
CVE-2023-24126
Jensen of Scandinavia Eagle 1200AC V15.03.06.33en was discovered to contain a stack overflow via the wepkey45g parameter at /goform/WifiBasicSet...
CVE-2023-24125
Jensen of Scandinavia Eagle 1200AC V15.03.06.33en was discovered to contain a stack overflow via the wepkey25g parameter at /goform/WifiBasicSet...
CVE-2023-24127
Jensen of Scandinavia Eagle 1200AC V15.03.06.33en was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet...
CVE-2023-24118
Jensen of Scandinavia Eagle 1200AC V15.03.06.33en was discovered to contain a stack overflow via the security parameter at /goform/WifiBasicSet...