CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: aws-flb-cloudwatch, q, s5cmd, docker-credential-acr-env, stakater-reloader, local-path-provisioner, thanos, golangci-lint, regclient, metrics-server, php-fpmexporter, bazelisk, k8ssandra-operator, configmap-reload, kyverno-policy-reporter-kyverno-plugin, caddy,...

ATSUMI Electric OET-213H-BTS1 Security Vulnerability

The ATSUMI Electric OET-213H-BTS1 is a temperature detection device from ATSUMI Electric. ATSUMI Electric OET-213H-BTS1 suffers from a security vulnerability that originates from allowing an unauthenticated attacker to execute the API...

CVE-2021-44716 affecting package node-problem-detector for versions less than 0.8.10-20

CVE-2021-44716 affecting package node-problem-detector for versions less than 0.8.10-20. A patched version of the package is available...

CVE-2022-21698 affecting package node-problem-detector for versions less than 0.8.10-19

CVE-2022-21698 affecting package node-problem-detector for versions less than 0.8.10-19. A patched version of the package is available...

Juniper SRX Firewall / EX Switch Remote Code Execution

Exploit Title: juniper-SRX-Firewalls&EX-switches PreAuth-RCE PoC Description: This code serves as both a vulnerability detector and a proof of concept for CVE-2023-36845. It executes the phpinfo function on the login page of the target device, allowing to inspect the PHP configuration. also this...

MachineSense FeverWarn Input Validation Error Vulnerability

MachineSense FeverWarn is a temperature detection device from MachineSense. MachineSense FeverWarn has an input validation error vulnerability that stems from incorrect validation of input...

CVE-2023-50094

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/wafdetector/?url= string. The commands are executed as root via subprocess.checkoutput...

Command injection

reNgine through 2.0.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/wafdetector/?url= string. The commands are executed as root via subprocess.checkoutput...

CVE-2023-50094

The CVE-2023-50094 vulnerability affects reNgine (before 2.1.2). Affected component is the web API path including api/tools/waf_detector/?url= where shell metacharacters can be injected by an authenticated user, leading to OS command execution as root via subprocess.check_output. Documented impac...

PT-2024-13859 · Rengine · Rengine

Name of the Vulnerable Software and Affected Versions: reNgine versions prior to 2.1.2 Description: The issue allows OS Command Injection if an adversary has a valid session ID. The attack involves placing shell metacharacters in an "api/tools/waf detector/?url=" string. The commands are executed...

CVE-2023-50094

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/wafdetector/?url= string. The commands are executed as root via subprocess.checkoutput...

CVE-2023-51449

creationtimestamp| type| source ---|---|--- 2023-12-22 22:22:12+00:00| seen| https://t.me/ctinow/158638 2024-01-18 08:11:50+00:00| seen| https://t.me/ctinow/169610 2024-04-01 13:07:17+00:00| published-proof-of-concept|...

AZL-35443 CVE-2023-48795 affecting package node-problem-detector for versions less than 0.8.20-2

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubeflow, kubeflow-fips, cortex, buildkitd, aactl, conftest-fips, slsa-verifier, src, terraform-provider-sendgrid-fips, vault-csi-provider, bank-vaults-fips, dgraph, k3d, dynamic-localpv-provisioner-fips, prometheus-stackdriver-exporter, scorecard, spark-operator,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: up, buildkitd, kubeflow, prometheus-blackbox-exporter, spark-operator, kubevela, k3d, terraform-provider-sendgrid, aactl, dgraph, kubescape, scorecard, src, slsa-verifier, cortex...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kubeflow, stakater-reloader, metrics-server, secrets-store-csi-driver, hey, terraform-provider-aws, flux-notification-controller, nats, memcached-exporter, kubewatch, pulumi-language-yaml, aws-efs-csi-driver, terraform-provider-azurerm, spark-operator, dex, bom,...

AZL-31336 CVE-2023-44487 affecting package node-problem-detector for versions less than 0.8.10-16

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-35038 CVE-2023-44487 affecting package node-problem-detector for versions less than 0.8.10-16

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Caracal - Static Analyzer For Starknet Smart Contracts

Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts. Features Detectors to detect vulnerable Cairo code Printers to report information Taint analysis Data flow analysis framework Easy to run in Scarb projects Installation Precompiled binaries Precompiled...

CVE-2023-2352

The CHP Ads Block Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.4. This is due to missing or incorrect nonce validation on the chpabdaction function. This makes it possible for unauthenticated attackers to update or reset plugin...