CVE-2023-39000

A reflected cross-site scripting XSS vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path...

Deciso OPNsense Cross-Site Scripting Vulnerability

Deciso OPNsense is a suite of FreeBSD-based open source firewall and routing software from Dutch company Deciso. A cross-site scripting vulnerability exists in OPNsense versions prior to 23.7, which stems from a reflected cross-site scripting XSS vulnerability in component...

PT-2023-26726 · Opnsense · Opnsense Community Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: A reflected cross-site scripting XSS issue exists in the /ui/diagnostics/log/core/ component, allowing attackers to inject...

The vulnerability of the SAP Solution Manager (Diagnostics agent) platform, related to the lack of mechanisms for encoding or blocking output data, allows for the execution of XSS attacks.

The vulnerability of the SAP Solution Manager Diagnostics agent platform is related to the lack of mechanisms for encoding or blocking output data. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the SAP Solution Manager (Diagnostics agent) platform, related to insufficient validation of incoming requests, allows a perpetrator to disclose protected information or cause service failures.

The vulnerability of the SAP Solution Manager Diagnostics agent platform lies in insufficient validation of incoming requests. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service failures by sending specially crafted HTTP requests...

CVE-2023-3731

Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: High...

CVE-2023-3731

Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: High...

Design/Logic Flaw

Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: High...

CVE-2023-3731

Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: High...

CVE-2023-3731

CVE-2023-3731 affects Google Chrome on ChromeOS prior to 115.0.5790.131, where a use-after-free in Diagnostics could be triggered by a user-installed malicious extension, potentially enabling heap corruption. The vulnerability is tied to Diagnostics handling in ChromeOS, with high severity. Publi...

PT-2023-25899 · Google · Google Chrome

Name of the Vulnerable Software and Affected Versions: Google Chrome on ChromeOS versions prior to 115.0.5790.131 Description: The issue allows an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. This can occur d...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a web browser from Google, Inc. Google Chrome version 115.0.5790.98 previously contained a resource management error vulnerability that stemmed from a post-release reuse issue in Diagnostics...

Malicious code in @ms-atlas/datastudio-diagnostics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3f339799f51093d5209c8cdce0977b24869016867c813f0abcfc5143e81f921 The OpenSSF Package Analysis project identified '@ms-atlas/datastudio-diagnostics' @ 0.2.10 npm as malicious. It is considered malicious because...

pfSense v2.7.0 - OS Command Injection Exploit

Exploit Title: pfSense v2.7.0 - OS Command Injection Exploit Author: Emir Polat CVE-ID : CVE-2023-27253 class MetasploitModule 'pfSense Restore RRD Data Command Injection', 'Description' = %q This module exploits an authenticated command injection vulnerabilty in the "restorerrddata" function of...

The vulnerability of the Diagnostics component of the Oracle Applications Framework software, a system for automating business operations in enterprises under the Oracle E-Business Suite, allows a perpetrator to gain access to and modify data.

The vulnerability of the Diagnostics component of the Oracle Applications Framework software in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain access to read, modify, add, or delete dat...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, and other functions. A security vulnerability exists in the Oracle...

PT-2023-3623 · Oracle · Oracle E-Business Suite +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.3.12 Description: The issue is related to insufficient input validation in the Diagnostics component of the Oracle Applications Framework product. It allows an unauthenticated attacker with...

Mozilla: Lack of warning when opening Diagcab files

The Mozilla Foundation Security Advisory describes this flaw as: When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code...

pfSense Restore RRD Data Command Injection

This module exploits an authenticated command injection vulnerabilty in the "restorerrddata" function of pfSense prior to version 2.7.0 which allows an authenticated attacker with the "WebCfg - Diagnostics: Backup & Restore" privilege to execute arbitrary operating system commands as the "root"...

.NET Core Multiple Vulnerabilities (KB5028705, KB5028706) - Windows

.NET Core prone to security feature bypass and elevation of privilege vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...