Drupal PHP Object Injection Vulnerability (SA-CORE-2024-008) - Linux

Drupal is prone to a PHP object injection vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7,7.x-3.0...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Unauthenticated Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure vulnerability discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7,7.x-3.0...

SUSE Linux SEoL (7.x)

According to its version, SUSE Linux is 7.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable,...

CentOS SEoL (7.x)

According to its version, CentOS is 7.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable, Inc...

MongoDB Missing Authorization Check Vulnerability (SERVER-79327) - Windows

MongoDB is prone to a missing authorization check vulnerability in refine collection shard key. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

MongoDB Improper Validation Vulnerability (SERVER-85263) - Linux

MongoDB is prone to an improper validation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb"; if...

Drupal Core Remote Code Execution Vulnerability

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical -...

Input validation

A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8 allows attacker to execute unauthorized code or commands via specially crafted packets...

BIT-ELASTICSEARCH-2022-23708

A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “” index permissions access to this index...

Atlassian Confluence 7.x < 7.19.16 Improper Authorization

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.x prior 7.19.6, 8.x prior to 8.3.4, 8.4.x prior to 8.4.4, 8.5.x prior to 8.5.3 or 8.6.x prior to 8.6.1. It is, therefore, affected by an improper authorization vulnerability. Note...

Curl Arbitrary File Write 7.x >= 7.84.0 / 8.x <= 8.1.2 (CVE-2023-32001)

The version of Curl installed on the remote host is between 7.84.0 and 8.1.2. It is therefore affected by an arbitrary file write vulnerability. Curl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called stat followed by fopen in a way that made it vulnerable t...

Elastic Kibana Reporting Vulnerability (ESA-2021-13)

Elastic Kibana is prone to a reporting vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elastic:kibana";...

PT-2022-20888 · Concourse · Concourse

Name of the Vulnerable Software and Affected Versions: Concourse versions 6.x.y prior to 6.7.9 Concourse versions 7.x.y prior to 7.8.3 Description: The issue is an authorization bypass that allows a Concourse user to send a request with a body including :team name=team2 to bypass team scope check...

Grafana Privilege Escalation Vulnerability (GHSA-jv32-5578-pxjc)

Grafana is prone to a privilege escalation vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

TYPO3 Information Disclosure Vulnerability (TYPO3-CORE-SA-2022-007)

TYPO3 is prone to an information disclosure vulnerability SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3"; if...

GHSA-JF86-9434-F8C2 Keycloak Authentication Error

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server ldaps, in this case user authentication succeeds even if invalid password has entered...

Drupal Open Redirect

Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging 1 custom code or 2 a form shown on a 404 error page, related to path manipulation...

CVE-2022-29479

On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, when an IPv6 self IP address is configured and the ipv6.strictcompliance...

CVE-2022-23023

On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ all versions of 8.x and 7.x, undisclosed requests by an authenticated iControl REST user can cause an increase in memory resource utilization. Note: Software...