CVE-2018-19454

The connected document identifies a concrete vulnerability in yiisoft/yii2: information disclosure caused by credentials (e.g., HTTP auth username/password) being logged in the application’s logging target (\yii\log\Target). An attacker who can access the log files could retrieve these credential...

CVE-2019-11075

HashiCorp Vault is vulnerable to information disclosure via an in-memory cache on performance standby nodes not being purged when a mount filter excludes the secondary cluster. The result is exposure of mount configuration data that can lead to token or lease issuance. The available connected doc...

CVE-2019-11075

This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2019-17196

The connected Veracode entry (VERACODE:20781) identifies a concrete vulnerability in Apache Kafka described as a Validation Bypass. An authenticated attacker with Write Permission can craft a Produce Request that bypasses ACL validation, enabling potential data integrity impact. This CVE’s public...

CVE-2018-20142

CVE-2018-20142 (reserved CVE) | Affected component: the sharrre library. Vulnerability: Cross-site scripting (XSS) vulnerability in which a remote attacker can inject arbitrary JavaScript into a victim’s browser via the location hash. Impact (as described): attacker could steal session tokens or ...

CVE-2017-11859

Technical details for CVE-2017-11859 are not publicly available in the provided documents. Monitor for updates; no affected products, root cause, or remediation information is disclosed here.

CVE-2023-20099

Technical details for CVE-2023-20099 are not publicly available in the provided documents. Monitor for updates and the release of concrete information on affected products, impact, and remediation.

CVE-2023-23655

CVE-2023-23655 relates to the WordPress plugin MainWP Code Snippets Extension (< =4.0.2). The vulnerability is due to Broken Access Control: there is no authorization check when updating plugin settings, which could let any authenticated user (e.g., a subscriber) modify settings. Affected vers...

UBUNTU-CVE-2023-27655

REJECT DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2019-9587. Reason: This record is a reservation duplicate of CVE-2019-9587. Notes: All CVE users should reference CVE-2019-9587 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...

CVE-2020-24470

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none...

CVE-2014-4920

The CVE-2014-4920 entry is confirmed to have concrete details in connected documents: the twitter-bootstrap-rails Gem for Rails contains a reflected XSS flaw in the bootstrap_flash helper, caused by inadequate input validation when handling flash messages before rendering to users. This can allow...

CVE-2023-26076

CVE-2023-26076 affects Samsung Exynos mobile chipset/modem family (Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123). The issue is an intra-object overflow in the 5G SM message codec caused by insufficient parameter validation when decoding reserved options, enabl...

CVE-2022-43879

CVE-2022-43879 is an SSRF vulnerability reported by IBM affecting IBM Jazz Team Server (ELM) versions 7.0.1 and 7.0.2, with remediation via iFix022/iFix023. Separate IBM advisories also document the same CVE affecting QRadar WinCollect/WinCollect Agent versions 10.0–10.1.2, with remediation by up...

CVE-2022-4134

Removed by vendor...

CVE-2023-26937

REJECT DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2019-9587. Reason: This record is a reservation duplicate of CVE-2019-9587. Notes: All CVE users should reference CVE-2019-9587 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...

CVE-2019-4660

CVE-2019-4660 is an AngularJS client-side template injection vulnerability affecting IBM InfoSphere Information Analyzer and Information Server on Cloud. The issue allows injection of AngularJS template syntax in an internal page request, which can be interpreted by Angular and lead to cross-site...

CVE-2019-4711

CVE-2019-4711 is detailed in IBM’s Security Bulletin for IBM Business Automation Workflow (BAW) 19.0.0.2 with fix JR61324. The issue is an unvalidated TLS certificate import during the registration process to the Resource Registry, allowing a man‑in‑the‑middle attacker to add a signer certificate...

CVE-2018-1966

IBM Security Identity Manager Virtual Appliance (VA) versions 7.0.1–7.0.1.11 are affected by CVE-2018-1966, where error messages disclose sensitive information about the environment, users, or data. This is part of multiple vulnerabilities addressed in the IBM bulletin for ISIM VA, which also lis...

CVE-2019-4504

CVE-2019-4504 affects IBM API Connect (2018 releases). The IBM bulletin notes a vulnerability in API Connect that could inadvertently remove some security patches, potentially exposing the machine to additional attacks. Affected products/versions: IBM API Connect 2018.1–2018.4.1.6. Remediation: f...

CVE-2019-4469

IBM InfoSphere Information Server is confirmed vulnerable to a reflected cross-site scripting (CVE-2019-4469) in the Web UI. Affected products/versions include IBM InfoSphere Information Server (11.3, 11.5, 11.7) and InfoSphere Server on Cloud (11.5, 11.7). The vulnerability allows an attacker to...