CVE-2024-0387 EDS-4000/G4000 Series IP Forwarding Vulnerability

The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests...

Fedora 39 : caddy (2024-22b915e51a)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-22b915e51a advisory. Update to the latest upstream version, which includes a fix for CVE-2023-45142. https://github.com/caddyserver/caddy/releases/tag/v2.7.6 Tenable has extracte...

XunRuiCMS Cross-Site Scripting Vulnerability (CNVD-2024-12713)

XunRuiCMS XunRui CMS is an open source content management system CMS. A cross-site scripting vulnerability exists in XunRuiCMS v4.6.2 and earlier versions. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by remo...

CVE-2024-24388

Cross-site scripting XSS vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious requests to the background login...

CVE-2024-24388

Cross-site scripting XSS vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious requests to the background login...

RHEL 8 : OpenShift Container Platform 4.12.48 (RHSA-2024:0489)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0489 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...

K000138255: Go OpenTelemetry Contrib vulnerability CVE-2023-47108

Security Advisory Description OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the...

The vulnerability of the web interfaces of Ivanti Connect Secure and Ivanti Policy Secure control devices allows a perpetrator to execute arbitrary commands.

The vulnerability of the Web interfaces of Ivanti Connect Secure and Ivanti Policy Secure lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending...

Code injection

The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log...

Denial Of Service (DoS)

github.com/cubefs/cubefs is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of incoming HTTP requests in a CubeFS HandlerNode that could allow an authenticated users to send maliciously-crafted requests that would crash the ObjectNode. An attacker can send a...

GHSA-QC6V-G3XW-GRMX Authenticated users can crash the CubeFS servers with maliciously crafted requests

A security vulnerability was found in CubeFS HandlerNode that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cause was improper handling of incoming HTTP requests that could allow an attacker to...

CVE-2023-46738 Authenticated users can crash the CubeFS servers with maliciously crafted requests

CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cau...

CVE-2023-46738 Authenticated users can crash the CubeFS servers with maliciously crafted requests

CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cau...

CVE-2023-51451

Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via...

CVE-2023-50705

An attacker could create malicious requests to obtain sensitive information about the web server...

CVE-2023-50705

An attacker could create malicious requests to obtain sensitive information about the web server...

Code injection

An attacker could create malicious requests to obtain sensitive information about the web server...

CVE-2023-50705 Exposure of Sensitive Information to an Unauthorized Actor in EFACEC UC 500E

An attacker could create malicious requests to obtain sensitive information about the web server...

EFACEC UC 500 Information Disclosure Vulnerability

EFACEC UC 500 is a solution from EFACEC Portugal that provides an integrated and flexible communication gateway, automation platform and HMI solution for utility and industrial applications. The EFACEC UC 500 suffers from an information disclosure vulnerability that originates from the possibilit...

Dreamer CMS Cross-Site Request Forgery Vulnerability (CNVD-2024-0021652)

Dreamer CMS is a dreamer content management system. A cross-site request forgery vulnerability exists in Dreamer CMS v4.1.3, which stems from the component /admin/database/backup not adequately verifying whether a request comes from a trusted user, and can be exploited by an attacker to forge a...