CVE-2023-26142

All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the setheader and addheader functions. An attacker can add the \r\n carriage return line feeds...

CVE-2023-29332: Use of Insufficiently Random Values

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability...

CVE-2023-40611: Incorrect Authorization

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to...

Oracle Linux 9 : samba (ELSA-2023-2519)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-2519 advisory. - resolves: rhbz2154373 - Fix CVE-2022-38023 - Fix CVE-2022-1615 GnuTLS gnutlsrnd can fail and give predictable random values - resolves: rhbz2108332 - Fix...

CVE-2020-10131

SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter...

SearchBlox Security Breach

SearchBlox is an application from US-based SearchBlox, Inc. provides a powerful enterprise search architecture for on-premise or cloud deployments. A security vulnerability exists in SearchBlox versions prior to 9.2.1. An attacker can exploit the vulnerability to perform a CSV macro injection...

Jenkins Plugin Job Configuration History Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

FreeRDP Buffer Overflow DoS

The vulnerability of the RDP client FreeRDP relates to the escape of operations beyond the buffer in memory when processing values of the rect-left and rect-top parameters. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

CVE-2023-39979

There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values...

Authentication flaw

There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values...

CVE-2023-39979: Small Space of Random Values

There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values...

PT-2023-25495 · Gnome +1 · Gnome Time Tracker +1

Name of the Vulnerable Software and Affected Versions: GNOME time tracker version 3.0.2 Description: The issue allows local attackers to execute arbitrary code via a crafted .tsv file when creating a new record. This is a result of a CSV Injection vulnerability in the GNOME time tracker...

Denial Of Service (DoS)

radare2 is vulnerable to Denial of Service DoS attacks. The vulnerability exists in the rsleb128 function in the radare2 codebase. The function is responsible for decoding SLEB128 encoded values. The vulnerability occurs when the function fails to properly check the size of a buffer. This can all...

Prevent logging invalid header values

Impact What kind of vulnerability is it? Apollo Server can log sensitive information Studio API keys if they are passed incorrectly with leading/trailing whitespace or if they have any characters that are invalid as part of a header value. Who is impacted? Users who all of the below: use either t...

GHSA-J5G3-5C8R-7QFX Prevent logging invalid header values

Impact What kind of vulnerability is it? Apollo Server can log sensitive information Studio API keys if they are passed incorrectly with leading/trailing whitespace or if they have any characters that are invalid as part of a header value. Who is impacted? Users who all of the below: use either t...

Prevent logging invalid header values

Impact What kind of vulnerability is it? Apollo Server can log sensitive information Studio API keys if they are passed incorrectly with leading/trailing whitespace or if they have any characters that are invalid as part of a header value. Who is impacted? Users who all of the below: use either t...

Exploit for Insufficient Verification of Data Authenticity in Rarlab Winrar

CVE-2023-38831 - WinRAR File Extension Spoofing Vulnerability...

Hitachi Energy AFF66x

1. EXECUTIVE SUMMARY ​CVSS v3 9.6 ​ATTENTION: Exploitable remotely/low attack complexity ​Vendor: Hitachi Energy ​Equipment: AFF66x ​Vulnerabilities: Cross-site Scripting, Use of Insufficiently Random Values, Origin Validation Error, Integer Overflow or Wraparound, Uncontrolled Resource...

CVE-2023-40350

Jenkins Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control responses from Docker...

CVE-2023-24478

Use of insufficiently random values for some Intel AgilexR software included as part of IntelR QuartusR Prime Pro Edition for linux before version 22.4 may allow an authenticated user to potentially enable information disclosure via local access...