Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2023-026)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2023-026 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Large handshake records may caus...

Cacti security breach

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool obtains data via snmpget, analyzes it using RRDtool drawing graphs, and provides data and user management features. A security vulnerability exists in Cacti versions prior to 1.2.6, which ste...

Deciso OPNsense Path Traversal Vulnerability

Deciso OPNsense is a suite of FreeBSD-based open source firewall and routing software from Dutch company Deciso. A path traversal vulnerability exists in OPNsense versions prior to 23.7, which stems from a directory traversal vulnerability in the Captive Portal template. An attacker can exploit...

F5 Networks BIG-IP : BIG-IP and BIG-IQ iControl SOAP vulnerability (K000133472)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.5.5 / 15.1.9.1 / 16.1.3.5 / 17.1.0.2. It is, therefore, affected by a vulnerability as referenced in the K000133472 advisory. - An authenticated attacker with guest privileges or higher can cause the iControl SOAP...

PYSEC-2023-280

OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0...

SUSE CVE-2023-3738

Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. Chromium security severity: Medium...

AZL-27410 CVE-2023-29406 affecting package golang for versions less than 1.20.7-1

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

CVE-2022-29562

A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.0, RUGGEDCOM ROX MX5000RE All versions V2.16.0, RUGGEDCOM ROX RX1400 All versions V2.16.0, RUGGEDCOM ROX RX1500 All versions V2.16.0, RUGGEDCOM ROX RX1501 All versions V2.16.0, RUGGEDCOM ROX RX1510 All versions V2.16.0...

OSNEXUS QuantaStor 跨站脚本漏洞

OSNEXUS QuantaStor is a unified software-defined storage platform from OSNEXUS Corporation. A cross-site scripting vulnerability exists in OSNEXUS QuantaStor versions prior to 6.0.0.355. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

TeamPass 跨站脚本漏洞

TeamPass is an open source password manager. TeamPass 3.0.10 prior to the version of the cross-site scripting vulnerability , the vulnerability stems from the Default session expiration time function of the user-supplied data lack of effective filtering and escaping , the vulnerability can be...

2FAuth 跨站脚本漏洞

2FAuth is a web application used to manage two-factor authentication 2FA accounts and generate their security code. A cross-site scripting vulnerability exists in 2FAuth versions prior to v4.0.3, which stems from the fact that it is possible to cause cross-site scripting via the account/service...

PT-2023-25706 · Sealos · Sealos

Name of the Vulnerable Software and Affected Versions: Sealos versions 4.2.0 and prior Description: Sealos, a Cloud Operating System for managing cloud-native applications, has a permission flaw in its billing system. This flaw allows users to control the recharge resource account via the...

Admidio 访问控制错误漏洞

Admidio is an open source member management system from the Admidio team. The system supports member lists, event management, guestbooks, photo albums, and downloads. An Access Control Error vulnerability exists in Admidio versions prior to 4.2.9 that stems from incorrect access control...

PT-2023-3543 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel versions prior to 1.3.6 Description: The issue is related to command injection when adding container repositories. An authenticated attacker can craft a malicious payload to achieve this. The vulnerability is due to the lack of proper...

CVE-2023-3227

CVE-2023-3227 targets fossbilling/fossbilling with insufficient granularity of access control prior to version 0.5.0. Affected component/condition: access-control checks lacking granularity (per multiple sources). Impact is described as insufficient access control, with remediation recommended to...

OpenITCOCKPIT 安全漏洞

It-novum OpenITCOCKPIT is an open source set of system monitoring tools from It-novum, Germany. A security vulnerability exists in OpenITCOCKPIT versions prior to 4.6.5 that stems from the presence of a race condition within a thread...

CVE-2023-3191 Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass

Cross-site Scripting XSS - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9...

PT-2023-23513 · Teampass · Teampass

Name of the Vulnerable Software and Affected Versions: teampass versions prior to 3.0.9 Description: The issue is related to Cross-site Scripting XSS - Stored, where some user input was not properly sanitized, potentially leading to stored cross-site scripting vectors in the application...

CVE-2023-27989

A buffer overflow vulnerability in the CGI program of the Zyxel NR7101 firmware versions prior to V1.00ABUV.8C0 could allow a remote authenticated attacker to cause denial of service DoS conditions by sending a crafted HTTP request to a vulnerable device...

curl: SFTP path ~ resolving discrepancy

A path traversal vulnerability exists in curl 8.0.0 SFTP implementation causes the tilde character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can...