14535 matches found
CVE-2023-30618: Insertion of Sensitive Information into Log File
Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values,...
PT-2025-49481
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the CIFS implementation related to the TCP Server Info::hostname component. Specifically, the hostname may be updated during reconnect attempts,...
PT-2023-22814 · Unknown · Kitchen-Terraform
Name of the Vulnerable Software and Affected Versions: Kitchen-Terraform version 7.0.0 Description: Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec...
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay
Impact A payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If t...
PT-2023-21170 · Npm · @Fastify/Csrf-Protection
Name of the Vulnerable Software and Affected Versions: @fastify/csrf-protection versions prior to 4.1.0 @fastify/csrf-protection versions prior to 6.3.0 Description: The CSRF protection mechanism in the @fastify/csrf-protection library can be bypassed by network and same-site attackers under...
PT-2025-38441
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue where a memory leak occurs when reading the fw info file completely, as the status tracking object is not freed after returning NULL, indicating no mor...
PT-2023-12984 · Onos · Onos
Name of the Vulnerable Software and Affected Versions: ONOS version 2.5.1 Description: An issue was discovered in ONOS where an intent with the same source and destination shows the INSTALLING state, indicating that its flow rules are installing. Improper handling of such an intent is misleading ...
Out-of-bounds
In deserialize of multiple files, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12...
CVE-2023-30557
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the datadictionary.py tableinfo. User input coming from the dbname in a...
CVE-2023-30614: Improper Neutralization of Input During Web Page Generation
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL...
CVE-2023-21082
The CVE-2023-21082 entry describes an information-disclosure flaw in Android related to getNumberFromCallIntent in NewOutgoingCallIntentBroadcaster.java. Affected: Android 11–13 (Android-11, Android-12, Android-12L, Android-13). Root cause: a confused deputy allows enumerating other users’ contac...
Used Routers Often Come Loaded With Corporate Secrets
More than half of the enterprise routers researchers bought secondhand hadn’t been wiped, exposing sensitive info like login credentials and customer data...
PT-2023-22784 · Archery · Archery
Name of the Vulnerable Software and Affected Versions: Archery affected versions not specified Description: The Archery project contains multiple SQL injection vulnerabilities that may allow an attacker to query connected databases. User input from the db name and tb name parameter values in the...
CVE-2023-27092
CVE-2023-27092 describes a Cross Site Scripting vulnerability in Jbootfly where an attacker can obtain sensitive information via the username parameter. Affected data exposure is indicated (confidentiality impact low; integrity impact low; availability none) with CVSSv3.1: Network attack vector, ...
Linux TLS DoS
The vulnerability in the implementation of the TLS protocol in the Linux operating system’s kernel is related to concurrent access to ctx-cryptosend.info between the functions dotlsgetsockoptconf and dotlssetsockoptconf in the net/tls/tlsmain.c module race condition. This vulnerability arises due...
CVE-2023-29203 Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm
XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with uorgsuggest.vm. This issue only concerns hidden users from main...
CVE-2023-29203 Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm
XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with uorgsuggest.vm. This issue only concerns hidden users from main...
Security Bulletin: OpenSSL vulnerabilities affect IBM Integrated Management Module II (IMM2) for System x, Flex and BladeCenter systems
Summary OpenSSL vulnerabilities affect IBM Integrated Management Module II IMM2 for System x, Flex and BladeCenter systems. Vulnerability Details Summary OpenSSL vulnerabilities affect IBM Integrated Management Module II IMM2 for System x, Flex and BladeCenter systems. Vulnerability Details CVE-I...
CVE-2023-29850
SENAYAN Library Management System SLiMS Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the user's geolocation and device information...