PT-2024-4754 · Docker · Docker Desktop

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.29.0 Description: The issue is related to insufficient restriction of the communication channel for given endpoints, allowing an attacker who has gained access to the Docker Desktop VM through a container...

Pentaho Business Analytics Server Information Disclosure

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server relates to the disclosure of information through a server error message. Exploiting this vulnerability allows an attacker to remotely disclose the protected information...

CVE-2023-6877

CVE-2023-6877 affects RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator for WordPress. It permits Stored Cross-Site Scripting via the plugin’s shortcode error messages (Content-Type) when retrieving an invalid RSS feed. Varies versions up to 4.3.3 are af...

PT-2024-15113

Name of the Vulnerable Software and Affected Versions The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress versions up to, and including, 4.3.3 Description The issue is related to Stored Cross-Site Scripting via the plugin's...

simpleamlphp/saml2 XML Security SAML Bypass

The vulnerability of the SAML protocol implementation in simpleamlphp/saml2 and the XML document security processing in simpleamlphp/xml-security is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a malicious actor to create a fake SAML message...

CVE-2024-25695

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to execute this attack...

CVE-2024-25695

CVE-2024-25695 affects Esri Portal for ArcGIS (versions 11.2 and below). It is a Cross-site Scripting vulnerability where input is not properly sanitized and rendered in error messages; no privileges are required and the attack can be executed by a remote, authenticated attacker. Public reference...

CVE-2024-25695 concatenated errors resulting in cross site scripting and frame injection issues.

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to execute this attack...

CVE-2024-25695 concatenated errors resulting in cross site scripting and frame injection issues.

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to execute this attack...

ssh: Prefix truncation attack on Binary Packet Protocol (BPP)

A flaw was found in the SSH channel integrity. By manipulating sequence numbers during the handshake, an attacker can remove the initial messages on the secure channel without causing a MAC failure. For example, an attacker could disable the ping extension and thus disable the new countermeasure ...

ssh: Prefix truncation attack on Binary Packet Protocol (BPP)

A flaw was found in the SSH channel integrity. By manipulating sequence numbers during the handshake, an attacker can remove the initial messages on the secure channel without causing a MAC failure. For example, an attacker could disable the ping extension and thus disable the new countermeasure ...

CVE-2024-3296

Removed by vendor...

CVE-2024-25695: Improper Neutralization of Input During Web Page Generation

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to execute this attack...

ROS-20240404-08

Vulnerability of GnuTLS transport layer cryptographic library is related to difference of response time when processing RSA ciphertext in ClientKeyExchange message with correct and incorrect addition of PKCS1. PKCS1 padding. Exploitation of the vulnerability could allow an attacker acting remotel...

PT-2024-21093 · Esri · Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Portal for ArcGIS versions prior to 11.2 Description: The issue is related to a Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error...

RabbitMQ HTTP Request Size DoS

The vulnerability of the RabbitMQ messaging broker lies in the lack of restrictions on the size of HTTP requests, which made it vulnerable to processing very large messages. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Google Sheets Grafana Information Disclosure

The vulnerability of the Google Sheets platform for monitoring and observation by Grafana involves improper handling of error messages, which potentially exposes key Google Sheets API details. Exploiting this vulnerability could allow an attacker to gain access to confidential data remotely...

bind9: Parsing large DNS messages may cause excessive CPU load

A flaw was found in the bind package. This issue may allow a remote attacker with no specific privileges to craft a specially long DNS message leading to an excessive and uncontrolled CPU usage, the server being unavailable, and a Denial of Service...

bind9: Parsing large DNS messages may cause excessive CPU load

A flaw was found in the bind package. This issue may allow a remote attacker with no specific privileges to craft a specially long DNS message leading to an excessive and uncontrolled CPU usage, the server being unavailable, and a Denial of Service...

CVE-2024-29948

There is an out-of-bounds read vulnerability in some Hikvision NVRs. An authenticated attacker could exploit this vulnerability by sending specially crafted messages to a vulnerable device, causing a service abnormality...