6849 matches found
CVE-2022-36777
IBM Cloud Pak for Security CP4S 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obtain sensitive version information that could aid in further attacks against the system. IBM X-Force ID: 233665...
CVE-2023-41145
Autodesk users who no longer have an active license for an account can still access cases for that account...
Automattic: Timeline API returns private post when target of a push notification
The Timeline API was able to return private posts when the target of a push notification, even though the user did not have access to the post...
Oracle Linux 8 : procps-ng (ELSA-2023-7187)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-7187 advisory. - CVE-2023-4016: ps: possible buffer overflow Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...
MGASA-2023-0320 Updated haproxy packages fix security vulnerability
Haproxy has fixed security and other issues in last upstream version 2.8.3 of branch 2.8 Default user access are now commented out to prevent local action possible exploit and prevent further rpmnew on future updates. Use a check script to have config check result in error log on failure. Fix...
Design/Logic Flaw
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to graph.php to access graphs generated on t...
kernel: Denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c
A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of...
Aruba Networks ArubaOS and InstantOS Command Injection Vulnerability
Aruba Networks ArubaOS and Aruba Networks InstantOS are both products of Aruba Networks, Inc. Aruba Networks InstantOS is an Arch Linux-based distribution. Aruba Networks ArubaOS and InstantOS have a security vulnerability that stems from multiple authenticated command injection vulnerabilities i...
CVE-2023-4804 Quantum HD Unity
An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed...
CVE-2023-39338 - Authenticated user access protected Sentry service vulnerability
Created Date Nov 9, 2023 4:55:32 PM...
insights-client: unsafe handling of temporary files and directories
A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...
kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid
A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -...
CVE-2023-24852 Improper Authentication in Core
Memory Corruption in Core due to secure memory access by user while loading modem image...
CVE-2023-41357
Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary...
F5 Networks BIG-IP : RSRE Variant 3a vulnerability (K51801290)
The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K51801290 advisory. Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may...
SUSE CVE-2015-3142
The kernel-invoked coredump processor in Automatic Bug Reporting Tool ABRT does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensitive information by leveraging write permissions to the working directory of a crashed application...
SUSE CVE-2016-4446
The allowexecstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filename, related to the commands.getoutput function...
A fully blacklisted user can withdraw their funds
Lines of code Vulnerability details Impact A fully blacklisted user should not have access to any function of the protocol, but it is possible for a user to withdraw their funds right before being blacklisted. A fully blocked user is capable of frontrunning the addToBlacklist call by calling the...