CVE-2023-43667

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log records, making it harder to audit and trace malicious...

CVE-2023-41365

SAP Business One B1i - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited impact on the confidentiality and no...

Sql injection

SAP Business One B1i - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited impact on the confidentiality and no...

CVE-2023-41365

The CVE-2023-41365 issue affects SAP Business One (B1i) 10.0. An authorized attacker can retrieve the fault message stack trace to perform an XML External Entity (XXE) injection, causing information disclosure. The documented impact is limited to confidentiality with no impact to integrity or ava...

Radius authentication failure

According to network trace captured on NetScaler, there is no response from radius server after NetScaler sending Access-Request packet toradius server. This issue occurred suddenly, and the related configuration of radius authentication on NetScaler has not changed...

Apache Superset Information Disclosure Vulnerability (CNVD-2023-70276)

Apache Superset is an open source data visualization tool based on Python. A security vulnerability in the Apache Superset stack trace error handling can be exploited by a remote attacker to submit a special request that can obtain sensitive information...

club.mrxiao:express-java-common (>=1.0.0 <=1.0.2), club.mrxiao:express-java-jdl (>=1.0.0 <=1.0.2) +439 more potentially affected by CVE-2023-42278 via cn.hutool:hutool-json (>=4.0.0 <=5.8.21)

cn.hutool:hutool-json MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.3, =2.0.5, =2.0.1.B, =2.0.1.B, =2.0.1.B, =1.0.1, =1.0.3 and more Source cves: CVE-2023-42278 Source advisory: OSV:GHSA-RR66-QH5M-W6MX...

club.mrxiao:express-java-common (>=1.0.0 <=1.0.2), club.mrxiao:express-java-jdl (>=1.0.0 <=1.0.2) +439 more potentially affected by CVE-2023-42277 via cn.hutool:hutool-json (>=4.0.0 <=5.8.21)

cn.hutool:hutool-json MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.3, =2.0.5, =2.0.1.B, =2.0.1.B, =2.0.1.B, =1.0.1, =1.0.3 and more Source cves: CVE-2023-42277 Source advisory: OSV:GHSA-7P8C-CRFR-Q93P...

CVE-2023-39264

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0...

Apache Superset 安全漏洞

Apache Superset is an open source data visualization tool based on Python. A security vulnerability in the Apache Superset stack trace error handling can be exploited by a remote attacker to submit a special request that can obtain sensitive information...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

CVE-2023-4513

A denial of service vulnerability was found in Wireshark due to a memory leak in the Bluetooth SDP dissector. This issue may allow a remote attacker to induce a crash in Wireshark by injecting a malformed packet onto the wire or persuading someone to read a corrupted packet trace file...

Cross Site Scripting (XSS)

Keycloak is vulnerable to Cross Site Scripting XSS. The vulnerability is due to not sanitizing the username field when the same field is displayed back to the user on the user interface through browser. The attacker can include a malicious script in the username field and make that username field...

PT-2023-27169 · Amazon · Aws Sdk +1

Name of the Vulnerable Software and Affected Versions: OpenTelemetry Java Instrumentation versions prior to 1.28.0 Description: The issue is related to the instrumentation of Java applications using the AWS SDK v2 with Amazon Simple Email Service SES v1 API. When SES POST requests are instrumente...

OpenTelemetry Instrumentation for Java Information Disclosure Vulnerability

OpenTelemetry Instrumentation for Java is an OpenTelemetry open source Java agent JAR. An information disclosure vulnerability exists in OpenTelemetry Instrumentation for Java prior to version 1.28.0, which stems from the fact that when detecting a SES POST request, the request's query parameter ...

The vulnerability of the CmpTraceMgr component in CODESYS and Schneider Electric software products allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the CmpTraceMgr component in CODESYS and Schneider Electric software products relates to the ability to write data beyond the buffer boundaries into memory. Exploiting this vulnerability could allow a remote attacker to cause service interruptions or execute arbitrary code...

The vulnerability of the CmpTraceMgr component in CODESYS and Schneider Electric software products allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the CmpTraceMgr component in CODESYS and Schneider Electric software products relates to the ability to write data beyond the buffer boundaries into memory. Exploiting this vulnerability could allow a remote attacker to cause service interruptions or execute arbitrary code...

PYSEC-2023-125

FPE in paddle.trace in PaddlePaddle before 2.5.0. This flaw can cause a runtime crash and a denial of service...

PYSEC-2023-124

Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible...

Azure MCS catalog update fails with FailedToStartImagePreparationVm - CreateUpdateVm-1 timed out

Unable to update a machine catalog for an Azure hosted MCS deployment. The MCS process fails early about 15% into the update The error message shows "Error - Terminated", and the action name is "MCUpdateMachineCatalog" The full stack trace is similar to this : TerminatedStack Trace: at...