CVE-2023-49920 Apache Airflow: Missing CSRF protection on DAG/trigger

Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the executi...

Server Side Request Forgery (SSRF)

mlflow is vulnerable to Server Side Request Forgery SSRF. The vulnerability is caused by following redirects while fetching HTTP artifact contents within the model-versions/get-artifact endpoint. A malicious user can exploit this to access internal HTTPs servers and in the worst case achieve remo...

EazyDocs < 2.3.6 - Subscriber+ Arbitrary Posts Deletion and Document Management

Description The plugin does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. 1. Install the...

PT-2023-30137 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 3.7.0 through 3.17.18 GitHub Enterprise Server versions 3.8.0 through 3.8.11 GitHub Enterprise Server versions 3.9.0 through 3.9.6 GitHub Enterprise Server versions 3.10.0 through 3.10.3 Description: The issu...

SUSE CVE-2023-32728

The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution...

DEBIAN-CVE-2023-32728

The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution...

UBUNTU-CVE-2023-32728

The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution...

PT-2023-8850 · Zabbix +4 · Zabbix Agent 2 +5

Name of the Vulnerable Software and Affected Versions: Zabbix Agent 2 affected versions not specified Description: The issue is related to the Zabbix Agent 2 item key smart.disk.get not sanitizing its parameters before passing them to a shell command, which could lead to remote code execution. Th...

CVE-2023-46348

SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive information via StUrls::hookActionDispatcher and StUrls::getInstanceId methods...

CVE-2023-46348

SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive information via StUrls::hookActionDispatcher and StUrls::getInstanceId methods...

PT-2023-35641 · Fasterxml · Jackson-Dataformat-Xml

Name of the Vulnerable Software and Affected Versions: Jackson Dataformat YAML affected versions not specified Description: A security exception occurs in the Jackson Dataformat YAML library, specifically in the com.fasterxml.jackson.dataformat.yaml.YAMLParser class, when the currentName or...

CVE-2023-49877

IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote authenticated user to obtain sensitive information, caused by improper filtering of URLs. By submitting a specially crafted HTTP GET request, an attacker could exploit this vulnerability to view...

Information disclosure

Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of...

CVE-2023-47619 Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability

Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of...

Fortinet FortiVoice Security Vulnerability

Fortinet FortiSwitch and others are products of Fortinet, Inc. FortiSwitch is a switch product and Fortinet FortiVoice is a product of tine and others are products of tine, Inc. tine is a team collaboration software. A security vulnerability exists in Fortinet FortiVoiceEnterprise, FortiSwitch,...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.21 (SUSE-SU-2023:4709-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4709-1 advisory. Update to go1.21.5: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// schem...

Fortinet FortiWLM Operating System Command Injection Vulnerability

Fortinet FortiWLM is a wireless manager from Fortinet, Inc. Fortinet FortiWLM has an operating system command injection vulnerability that stems from the presence of operating system command injection. An attacker could execute unauthorized code or commands via specially crafted http get request...

PYSEC-2023-286

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs /files/get/?name=... and /files/download/?name=... are used to provid...

The vulnerability of the get_parentControl_list_Info() function in the Tenda AC10 router’s microprogramming software allows a attacker to execute arbitrary code or cause a service failure.

The vulnerability of the getparentControllistInfo function in the Tenda AC10 router’s microprogramming software is related to the execution of operations outside the buffer in memory when processing the urls parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary co...

PT-2024-14638

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A possible NULL pointer dereference in the wfx set mfp ap function has been resolved. The ieee80211 beacon get function can return NULL, and wfx set mfp ap should check the return value...