13372 matches found
CVE-2023-6832: Undefined Security Weakness
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0...
PT-2023-31626 · Github · Octokit/Webhooks +1
Name of the Vulnerable Software and Affected Versions: octokit/webhooks versions 9.26.0 through 9.26.2 octokit/webhooks versions 10.9.0 through 10.9.1 octokit/webhooks versions 11.1.0 through 11.1.1 octokit/webhooks versions 12.0.0 through 12.0.3 Description: The issue is caused by a problem with...
Power Platform Connector API Information Representation Issue
The vulnerability of the Microsoft Power Platform Connector’s application programming interface is related to errors in information representation by the user interface. Exploiting this vulnerability allows a malicious actor to carry out a spear-phishing attack by sending the user a specially...
ASUSTOR Data Master Privilege Bypass
The vulnerability of the ASUSTOR Data Master operating system is related to errors in privilege management. Exploiting this vulnerability could allow an attacker to modify the configuration of storage devices...
PYSEC-2023-307
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable needed used math.ceiltype.sizeinbytes / 32. T...
Code injection
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibanasystem user, API Keys, and...
CVE-2023-49922
An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or Elastic Agent...
CVE-2023-6687 Elastic Agent Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Elastic Agent attempted to ingest,...
golang: html/template: improper handling of special tags within script contexts
A flaw was found in Golang. The html/template package did not apply the proper rules for handling occurrences of " contexts. This issue may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped...
Elastic Security Breach
Elastic is the Netherlands Elastic company's set of open source distributed RESTful search engine built on Lucene . The product is mainly used in cloud computing and supports data indexing using JSON over HTTP. A security vulnerability exists in Elastic Agent and Beats versions 7.0.0 through...
MySQL Server DoS
The vulnerability of the MySQL Server component of the database management system involves errors in resource release. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...
IBM Informix Dynamic Server Buffer Error Vulnerability
IBM Informix Dynamic Server IDS is a scalable object-relational database server from International Business Machines IBM that provides clustered data centers with features such as continuous data availability and disaster recovery. A security vulnerability exists in IBM Informix Dynamic Server...
Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current libxml2 Multiple Vulnerabilities (SSA:2023-343-01)
The version of libxml2 installed on the remote host is prior to 2.12.2. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-343-01 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser...
Open redirect
An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP Open Charge Point Protocol for electric vehicles. It permits multiple transactions with the same connectorId and idTag, contrary to the expected ConcurrentTx status. This could result in critical transaction management and billing...
Microweber Business Logic Errors
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.0. Unpublished and deleted products can be added to checkout...
CVE-2023-6566
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0...
Code injection
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0...
CVE-2023-6566
CVE-2023-6566 describes business logic errors in microweber/microweber prior to 2.0. The root cause, as reflected in multiple sources, is a flaw in the CartManager.php get function that fails to verify whether items are unpublished or deleted before checkout. Affected product: microweber/microweb...
