Denial of service vulnerability on creating a Launch with too many recursively nested elements in reportportal

Impact ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1 test inside when the testitem.path field is exceeded the allowable "ltree" field type indexing limit path length=120 approximately, recursive nesting of the nested steps...

Command injection

An improper neutralization of special elements used in an os command 'os command injection' in FortiManager 7.4.0 and 7.2.0 through 7.2.3 may allow attacker to execute unauthorized code or commands via FortiManager cli...

CVE-2023-34985

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters...

CVE-2023-36415: Improper Neutralization of Special Elements used in a Command

Azure Identity SDK Remote Code Execution Vulnerability...

CVE-2023-43643

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the...

CVE-2023-43643 mXSS in AntiSamy

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the...

CVE-2023-25822 ReportPortal DoS vulnerability on creating a Launch with too many recursively nested elements

ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the com.epam.reportportal:service-api module, corresponding to ReportPortal version 23.2, the ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1...

CVE-2023-25822 ReportPortal DoS vulnerability on creating a Launch with too many recursively nested elements

ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the com.epam.reportportal:service-api module, corresponding to ReportPortal version 23.2, the ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1...

The vulnerability of the dns_zone_editor module of the Control Web Panel (CWP) application, which was previously known as CentOS Web Panel, allows a hacker to execute arbitrary code.

The vulnerability of the dnszoneeditor module of the Control Web Panel formerly CentOS Web Panel relates to the failure to take measures to neutralize special elements. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the yt-dlp download utility arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This vulnerability allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the YouTube-DLP download utility exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise the confidentiality, integrity, and accessibility of the protected informati...

Cross-site Scripting (XSS)

Overview HtmlSanitizer is a Cleans HTML from constructs that can be used for cross site scripting XSS. Affected versions of this package are vulnerable to Cross-site Scripting XSS when it is configured to allow foreign content, specifically svg or math elements. Notes: 1 This is only exploitable ...

The vulnerability of the command-line interface of ArubaOS systems allows a hacker to execute arbitrary commands.

The vulnerability of the command-line interface of ArubaOS exists because measures to neutralize special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the check_by_ssh.c component in the Nagios-plugins monitoring system allows a hacker to execute arbitrary commands.

The vulnerability of the checkbyssh.c component of the Nagios-plugins monitoring system relates to the lack of measures taken to neutralize special elements used in operating systems’ command lines. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely by...

The vulnerability of the conf_mail.php component in the microprogramming software for solar power generation, data display, and storage of SolarView Compact allows a hacker to execute arbitrary commands.

The vulnerability of the confmail.php component in the microprogramming software for solar power measurement, data display, and storage in SolarView Compact exists due to the lack of measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability can...

Qualcomm Chip Buffer Error Vulnerability

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc. and are often manufactured on the surface of semiconductor wafers. The Qualcomm chip suffers from a buffer error vulnerability that originates fr...

PT-2023-24149 · Unknown · Wlan Firmware

Name of the Vulnerable Software and Affected Versions: WLAN Firmware affected versions not specified Description: The issue is related to a transient Denial of Service DOS in WLAN Firmware that occurs while parsing rsn ies. There is no information provided about the estimated number of potentiall...

Ubuntu 22.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-6386-2)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6386-2 advisory. Jana Hofmann, Emanuele Vannacci, Cedric Fournet, Boris Kopf, and Oleksii Oleksenko discovered that some AMD processors could leak stale data from divisio...

CVE-2023-40046 WS_FTP Server SQL Injection via Administrative Interface

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WSFTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements...

The vulnerability of the SetHostIPv6StaticSettings function in the D-Link DAP-1325 wireless signal booster software allows a hacker to execute arbitrary code.

The vulnerability of the SetHostIPv6StaticSettings function in the microprogramming software of the D-Link DAP-1325 wireless signal booster relates to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2023-43765

Certain WithSecure products allow Denial of Service in the aeelf component. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure...