GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from the fact that file...

CVE-2023-6563

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens 500,000 users with each having at least 2 saved sessions. If an attacker creates two or more user sessions and then open the "consents" tab of th...

PT-2023-29889 · Ibm · Ibm Sterling Secure Proxy

Name of the Vulnerable Software and Affected Versions: IBM Sterling Secure Proxy versions 6.0.3 through 6.1.0 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trust...

CVE-2023-6563: Allocation of Resources Without Limits or Throttling

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens 500,000 users with each having at least 2 saved sessions. If an attacker creates two or more user sessions and then open the "consents" tab of th...

PT-2023-32694

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An unconstrained memory consumption issue was discovered. It can be triggered in environments with millions of offline tokens, specifically when there are more than 500,000 users, each havin...

Power Platform Connector API Information Representation Issue

The vulnerability of the Microsoft Power Platform Connector’s application programming interface is related to errors in information representation by the user interface. Exploiting this vulnerability allows a malicious actor to carry out a spear-phishing attack by sending the user a specially...

How to change time zone on NetScaler from GUI

This document is about how to change time zone on NetScaler...

KLA62433 SUI vulnerability in Microsoft Azure

A spoofing vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2023-21751 Exploitation Related products Microsoft-Azure CVE list CVE-2023-21751 high KB list Solution Install necessary updates from the KB...

CVE-2023-48429

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 2. The Web UI of affected devices does not check the length of parameters in certain conditions. This allows a malicious admin to crash the server by sending a crafted request to the server. The server will automaticall...

CVE-2023-49584

SAP Fiori launchpad - versions SAPUI 750, SAPUI 754, SAPUI 755, SAPUI 756, SAPUI 757, SAPUI 758, UI700 200, SAPBASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application...

CVE-2023-49578

SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious request which leads to low impact on the availability and no impact on confidentiality or Integrity of the application...

PT-2023-9082 · Extreme Networks · Extreme Networks Ap410C +1

Name of the Vulnerable Software and Affected Versions: Extreme Networks IQ Engine versions prior to 10.6r1a Extreme Networks IQ Engine versions 10.6r1a through 10.6r4 before 10.6r5 Extreme Networks AP410C affected versions not specified Description: The issue arises from the ah webui service, whi...

PT-2023-7776 · Microsoft · Windows Dpapi +1

Name of the Vulnerable Software and Affected Versions: Windows DPAPI affected versions not specified Description: The issue is related to errors in the representation of information by the user interface in the Windows DPAPI component. This can allow a remote attacker to conduct spoofing attacks...

PT-2023-7708 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in the representation of information by the user interface of the Windows DNS server. It allows a remote attacker to conduct spoofing attacks. Recommendations...

KLA62391 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability in Microsoft Outlook can be exploited remotely ...

KLA62390 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Connected Machine Agen...

KLA62388 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, cause denial of service, overwrite arbitrary files, gain privileges, spoof user interface. Below is a complete list of...

PT-2023-31263 · Sap · Sap Cloud Connector

Name of the Vulnerable Software and Affected Versions: SAP Cloud Connector version 2.0 Description: The issue allows an authenticated user with low privilege to perform a Denial of Service attack from an adjacent UI by sending a malicious request. This leads to a low impact on the availability of...

openSUSE 15 Security Update : libtorrent-rasterbar, qbittorrent (openSUSE-SU-2023:0391-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0391-1 advisory. - All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to...

VulnCheck KEV: CVE-2022-24288

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI...