Moderate: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2023-45064

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Daisuke TakahashiExtend Wings OPcache Dashboard plugin = 0.3.1 versions...

CVE-2023-45064

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Daisuke TakahashiExtend Wings OPcache Dashboard plugin = 0.3.1 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Daisuke TakahashiExtend Wings OPcache Dashboard plugin = 0.3.1 versions...

CVE-2023-45064

CVE-2023-45064: Unauthenticated reflected XSS in the OPcache Dashboard plugin for WordPress, affected versions

PT-2023-29383 · Daisuke Takahashi · Opcache Dashboard Plugin

Name of the Vulnerable Software and Affected Versions: Daisuke TakahashiExtend Wings OPcache Dashboard plugin versions = 0.3.1 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentiall...

Moderate: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 golang: net/http, x/net/http2: rapid stream resets can cause...

ALSA-2023:5863 Moderate: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: golang: net/http, x/net/http2: rapid stream resets can cause excessive work CVE-2023-39325 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS...

WordPress Plugin OPcache Dashboard Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress plugin User Activity Log Pro Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability in the WordPre...

PT-2023-7035 · Unknown +1 · Opensearch +2

Name of the Vulnerable Software and Affected Versions: OpenSearch versions prior to 1.3.14 OpenSearch versions prior to 2.11.0 Description: There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can...

Apache Superset 2.0.0 Remote Code Execution Exploit

Apache Superset versions 2.0.0 and below utilize Flask with a known default secret key which is used to sign HTTP cookies. These cookies can therefore be forged. If a user is able to login to the site, they can decode the cookie, set their userid to that of an administrator, and re-sign the cooki...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: atlantis-fips, pulumi, vertical-pod-autoscaler, grpcurl, secrets-store-csi-driver-provider-gcp, memcached-exporter, k3s, nodetaint, prometheus-blackbox-exporter, cue, azure-aad-pod-identity-mic, aws-efs-csi-driver-fips, smarter-device-manager-fips, metrics-server,...

CVE-2023-42455 Wazuh vulnerable to user privilege escalation

Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the AP...

CVE-2023-42455 Wazuh vulnerable to user privilege escalation

Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the AP...

The vulnerability of the Docker Swarm Dashboard component of the Jenkins Docker Swarm Plugin allows a attacker to perform cross-site scripting attacks.

The vulnerability of the Docker Swarm Dashboard component of the Jenkins Docker Swarm plugin is related to the lack of security measures for the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created link...

Curl 8.4.0 – Proactively Identifying Potential Vulnerable Assets

On Wednesday, October 4, 2023, the curl project maintainers announced pre-notification for curl version 8.4.0 to be released on October 11. This version will fix two new vulnerabilities with one high and one low-severity CVE. The prenotification stated that the high-severity issue is arguably the...

CVE-2023-43793

Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds...

Authentication flaw

Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possibl...

Mozilla: Mozilla Employee's Token for sql.telemetry.mozilla.org Exposed in Git Commit

A Mozilla employee's API token was exposed in a GitHub repository, granting access to confidential data. The token was rotated and removed from the service...