Etcd pkg Insecure ciphers are allowed by default

Vulnerability type Cryptography Detail The TLS ciphers list supported by etcd contains insecure cipher suites. Users can configure the desired ciphers using the “--cipher-suites” flag, and a default list of secure cipher suites is used if empty. Workarounds By default, no action is required. If...

Duplicate

This advisory duplicates another...

CVE-2023-4284

creationtimestamp| type| source ---|---|--- 2023-09-04 16:16:40+00:00| seen| https://t.me/cibsecurity/69793 2025-03-19 21:02:04+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lkr3emgrld2s...

PT-2023-29467 · Undefined · Undefined

‼ CVE-2023-4524 ‼ REJECT CVE reject in favor of CVE-2023-40547 📖 Read via "National Vulnerability Database"...

Exploring ICA Login and Logout Records in NetScaler logs

This articlestates the essential ICA login and logout records contained within the NetScaler's "/var/log/ns.log."...

GSD-2023-1000528 net: stmmac: fix errno when create_singlethread_workqueue() fails

net: stmmac: fix errno when createsinglethreadworkqueue fails This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

Open redirect on government website sends users to adult content

Fake websites and open redirects have conspired to make things awkward for a UKGOV website. The site in question, riverconditionsdotenvironment-agencydotgovdotuk, was being abused in search engine results to redirect to various sites which arent associated with UKGOV--most of which were adult...

CVE-2022-0783

creationtimestamp| type| source ---|---|--- 2022-05-02 20:27:59+00:00| seen| https://t.me/cibsecurity/41734 2025-05-28 08:04:58+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2022/CVE-2022-0783.yaml...

Design/Logic Flaw

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional...

Remote code execution

DISPUTED An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The...

CVE-2022-28397

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional...

CVE-2022-28397

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional...

CVE-2022-27139

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...

CVE-2022-27139

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...

GHSA-R9CR-HVJJ-496V Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been...

CVE-2022-23277

creationtimestamp| type| source ---|---|--- 2022-03-09 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=752 2022-06-29 11:03:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/6298 2022-08-19 16:31:57+00:00| seen|...

CloudSpec - An Open Source Tool For Validating Your Resources In Your Cloud Providers Using A Logical Language

CloudSpec is an open source tool for validating your resources in your cloud providers using a logical language that everybody can understand. With its reasonably simple syntax, you can validate the configuration of your cloud resources, avoiding mistakes that can lead to availability or...

CVE-2021-26828

creationtimestamp| type| source ---|---|--- 2021-05-14 01:56:05+00:00| seen| https://t.me/pwnwikizhchannel/422 2022-07-04 22:17:17+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/3610 2023-12-12 01:23:48+00:00| seen| https://t.me/arpsyndicate/1785 2025-01-06...

CVE-2021-25299

creationtimestamp| type| source ---|---|--- 2021-02-15 16:46:42+00:00| seen| https://t.me/cibsecurity/23592 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-25299.yaml...

CVE-2020-11710

An issue was discovered in docker-kong for Kong through 2.0.3. The admin API port may be accessible on interfaces other than 127.0.0.1. NOTE: The vendor argue that this CVE is not a vulnerability because it has an inaccurate bug scope and patch links. “1 Inaccurate Bug Scope - The issue scope was...