GHSA-C4CM-R9FH-JGJ9 commonground-api-common unexploitable privilege escalation in JWT authentication middleware

Impact This is a privilege escalation vulnerability. The impact is negligible and entirely theoretical. A non-exploitable weakness was found in how the client-supplied JWTs are verified. Because an explicit allow-list of known algorithms is used in the PyJWT library, user-supplied invalid...

CVE-2024-0971

A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially alter scan DB content...

CVE-2024-20666

BitLocker Security Feature Bypass Vulnerability...

CVE-2024-20676

Azure Storage Mover Remote Code Execution Vulnerability...

GHSA-H63J-XQX6-W58R mvel2 TimeOut error exists in the ParseTools.subCompileExpression method

A TimeOut error exists in the ParseTools.subCompileExpression method in mvel2 v2.5.0 Final...

CVE-2023-35622

Windows DNS Spoofing Vulnerability...

CVE-2023-48425

U-Boot vulnerability resulting in persistent Code Execution...

CVE-2023-36027

Microsoft Edge Chromium-based Elevation of Privilege Vulnerability...

GHSA-3F38-96QM-R3FW esptool allows attackers to view sensitive information via weak cryptographic algorithm

An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm...

CVE-2023-42493

EisBaer Scada - CWE-256: Plaintext Storage of a Password...

PaperCut MF < 20.1.9 / 21.x < 21.2.13 / 22.x < 22.1.3 Multiple Vulnerabilities

The version of PaperCut MF installed on the remote Windows host is affected by multiple vulnerabilities, as follows: - An authentication bypass exists that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut host’s file storage. This could exhaust system...

AZL-28833 CVE-2023-38039 affecting package mysql for versions less than 8.0.35-1

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of header...

UBUNTU-CVE-2023-1576

REJECT This is a duplicate of an earlier CVE, CVE-2022-47069...

USN-6371-1 libssh2 vulnerability

It was discovered that libssh2 incorrectly handled memory access. An attacker could possibly use this issue to cause a crash...

CVE-2023-39914

NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding...

CVE-2023-38152

DHCP Server Service Information Disclosure Vulnerability...

UBUNTU-CVE-2023-4638

Unknown description...

CVE-2023-39372

StarTrinity Softswitch version 2023-02-16 - Multiple CSRF CWE-352...

BELL-CVE-2018-12543 CVE-2018-12543 does not affect BellSoft software

Bulletin has no description...

UBUNTU-CVE-2023-2905

Due to a failure in validating the length of a provided MQTTCMDPUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not...