CVE-2023-5562 Unsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business Hub

An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by...

PT-2023-32177 · Knime · Knime Analytics Platform

Name of the Vulnerable Software and Affected Versions: KNIME Analytics Platform versions prior to 5.2.0 Description: The issue is related to an unsafe default configuration that allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server ...

SAP Business Objects Web Intelligence 跨站脚本漏洞

SAP Business Objects Web Intelligence is a centralized suite from SAP, Germany. It is used for data reporting, visualization, and sharing. A cross-site scripting vulnerability exists in SAP Business Objects Web Intelligence version 420, which stems from the lack of effective filtering and escapin...

geokit-rails Command Injection vulnerability

Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geolocation' cookie. This issue can be exploited remotely via a malicious cookie value. Note: An attacker can use this vulnerability to execute commands on the...

The vulnerability of the nfs_lookup_reply function (net/nfs.c) in the U-Boot loader for embedded Linux operating systems allows a hacker to execute arbitrary code.

The vulnerability of the nfslookupreply function in the U-Boot loader for embedded Linux operating systems is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

OESA-2023-1693 ctags security update

Ctags generates an index or tag file of language objects found in source files that allows these items to be quickly and easily located by a text editor or other utility. A tag signifies a language object for which an index entry is available or, alternatively, the index entry created for that...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Java

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Java. Vulnerability Details CVEID:CVE-2022-40609 DESCRIPTION: IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by a...

Illumio PCE Code Issue Vulnerability

Illumio PCE is a computational engine from Illumio, Inc. Illumio PCE suffers from a security vulnerability that stems from the unsafe deserialization of untrusted JSON in the networktraffic API endpoint, which can be exploited by an attacker to execute code in the context of a user of the PCE...

The vulnerability of the update_banner_message() function in the Nagios XI monitoring tool allows a hacker to gain unauthorized access to protected information and execute arbitrary code.

The vulnerability of the updatebannermessage function in the Nagios XI monitoring tool is related to the lack of measures taken to protect the SQL query structure when processing the ID parameter. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access t...

DedeBIZ 安全漏洞

DedeBIZ is a content management system from China Muyun Intelligent Technology DedeBIZ company. A code execution vulnerability exists in DedeBIZ version v6.2.11, which stems from the $activepath and $filename parameters in /admin/filemanagecontrol.php failing to correctly filter the special...

Progress Software WS_FTP Unauthenticated Remote Code Execution

This module exploits an unsafe .NET deserialization vulnerability to achieve unauthenticated remote code execution against a vulnerable WSFTP server running the Ad Hoc Transfer module. All versions of WSFTP Server prior to 2020.0.4 version 8.7.4 and 2022.0.2 version 8.8.2 are vulnerable to this...

CVE-2023-5183 Authenticated RCE due to unsafe JSON deserialization

Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the networktraffic API endpoint. An attacker can leverage this vulnerability to execute...

Cross-site Scripting (XSS)

Overview quill-mention is a @mentions for the Quill rich text editor Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization, via the renderList function. Note: If the mentions list is sourced from unsafe user-sourced data, this might...

PT-2023-31897 · Illumio · Illumio Pce

Name of the Vulnerable Software and Affected Versions: Illumio PCE affected versions not specified Description: The issue is related to unsafe deserialization of untrusted JSON, which allows execution of arbitrary code on affected releases of the Illumio PCE. To exploit this, authentication to th...

Important: firefox

Issue Overview: The Mozilla Foundation describes this issue as follows: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. CVE-2023-1945 The Mozilla Foundation describes this issue as follows: A website could have obscured...

PT-2023-28746 · Unknown · Gladys Assistant

Name of the Vulnerable Software and Affected Versions: Gladys Assistant versions 4.26.1 and below Description: A path traversal issue allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-sanitized user input. Recommendations: For versions 4.26.1 and...

Important: ecs-service-connect-agent

Issue Overview: Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issu...

CVE-2023-2163

Incorrect verifier pruning in BPF in Linux Kernel =5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape...

CVE-2023-3892 Unsafe XML parsing of 3rd party DICOM private tags may lead to XXE

Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup. In order to take advantage of this vulnerability, an attacker must craft a malicious XML document, embed this docume...

CVE-2023-3892 Unsafe XML parsing of 3rd party DICOM private tags may lead to XXE

Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup. In order to take advantage of this vulnerability, an attacker must craft a malicious XML document, embed this docume...