SUSE CVE-2022-23709

A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a user with this...

Out-of-bounds Write

kernel is vulnerable to Out-of-bounds Write. The vulnerability exists because the kernel debugger could be used to bypass UEFI Secure Boot restrictions. An attacker with access to a serial port could trigger the debugger and allow read and write access...

PT-2023-19306 · Unknown +2 · Opensearch +2

Name of the Vulnerable Software and Affected Versions: OpenSearch versions prior to 1.3.8 OpenSearch versions prior to 2.6.0 Description: There is an issue with the application of document and field level restrictions in the Anomaly Detection plugin, where users with the Anomaly Detector role can...

GHSA-V3CG-7R9H-R2G6 Field-level security issue with .keyword fields in OpenSearch

Advisory title: Field-level security issue with .keyword fields Affected versions: OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1 Patched versions: OpenSearch 1.3.8 and 2.5.0 Impact: There is an issue in the implementation of field-level security FLS and field masking where rules written to explicitly...

Information Disclosure

apachesuperset is vulnerable to Information Disclosure. A remote authenticated attacker with read access to a specific database can add subqueries to the WHERE and HAVING fields, resulting in references to tables on the same database that the attacker should not have access to. The perimeter to...

CVE-2023-21885

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

CVE-2023-21889

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

UBUNTU-CVE-2023-21885

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

UBUNTU-CVE-2023-21889

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

Oracle Database Server 安全漏洞

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing and other functions. A security vulnerability exists in Oracle Database Server, which can be exploited by an...

Oracle PeopleSoft Enterprise PeopleTools 安全漏洞

Oracle PeopleSoft Enterprise PeopleTools is Oracle's technology for providing PeopleSoft applications with the ability to stay in sync with users' needs and expectations. A security vulnerability in Oracle PeopleSoft's PeopleSoft Enterprise PeopleTools 8.60 can be exploited by an attacker to caus...

Oracle PeopleSoft Enterprise PeopleTools 安全漏洞

Oracle PeopleSoft Enterprise PeopleTools is Oracle's technology for providing PeopleSoft applications with the ability to stay in sync with users' needs and expectations. A security vulnerability exists in PeopleSoft Enterprise CS Academic Advisement 9.2, which can be exploited by an attacker to...

PT-2023-7635 · Oracle · Oracle Isupplier Portal +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.6 through 12.2.8 Description: The issue is related to the Oracle iSupplier Portal product, specifically the Supplier Management component. It allows an unauthenticated attacker with network access via HTT...

Apache Superset SQL注入漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset versions 1.5.2 and earlier and 2.0.0 have a SQL injection vulnerability that stems from a problem with the SQL Alchemy connector, which allows an authenticated user with read acce...

PT-2023-14020

Name of the Vulnerable Software and Affected Versions Apache Superset versions 1.5.2 and prior Apache Superset version 2.0.0 Description A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the...

CVE-2022-46457

A segmentation fault caused by an invalid memory read access was found in NASM. The issue occurs when a specially crafted file is processed by NASM using the IEEE output file format, causing the application to crash...

The vulnerability of the SAP NetWeaver AS for Java software platform, related to access control deficiencies, allows an intruder to gain read-only access to data.

The vulnerability of the SAP NetWeaver AS for Java software platform is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read access to data...

CVE-2020-36559

Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...

The vulnerability of the Ldoms component in the Oracle Solaris operating system allows a perpetrator to gain read access to data, obtain privileged access to infrastructure, or cause partial service interruption.

The vulnerability of the Ldoms component in the Oracle Solaris operating system is related to errors in the code. Exploiting this vulnerability can allow an attacker to gain read access to data, obtain privileged access to infrastructure resources, or cause partial service interruption...

Foxit PDF Editor < 11.2.4 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 11.2.4. It is, therefore affected by multiple vulnerabilities: - A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF...