KLA51005 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, spoof user interface, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Implementation vulnerability in WebApp...

KLA50770 Multiple vulnerabilities in Microsoft Dynamics

Multiple vulnerabilities were found in Microsoft Dynamics. Malicious users can exploit these vulnerabilities to spoof user interface. Below is a complete list of vulnerabilities: 1. A cross-site-scripting XSS vulnerability Microsoft Dynamics 365 on-premises can be exploited remotely to spoof user...

KLA50772 PE vulnerability in Microsoft System Center

An elevation of privilege vulnerability was found in Microsoft System Center. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2023-33156 Related products Windows-Defender CVE list CVE-2023-33156 high KB list Solution Install necessary updates from the KB...

Policy Bypass

github.com/kubernetes/kubernetes is vulnerable to Policy Bypass. The vulnerability exists in imagepolicy/admission.go, when ephemeral containers are used, which allows malicious users to start containers using restricted images, impacting the cluster if the ImagePolicyWebhook admission plugin is...

Exploiter can avoid negative Lido rebases stealing funds from EUSD vaults

Lines of code Vulnerability details Description Lybra keeps the exact amount of collateral as deposited ignoring any lido rebases. That allows malicious users to sandwich negative rebase transactions with depositing and withdrawing their stETH saving the exact amount as before negative rebase. Th...

KLA50362 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in WebRTC can be exploited to cause denial of service or...

KLA50316 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, obtain sensitive information, spoof user interface, bypass security restrictions, cause denial of service. Below is a...

KLA50315 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, execute arbitrary code, bypass security restrictions, cause denial of service, spoof user interface. Below is a complete list of...

FreeBSD : Grafana -- Broken access control: viewer can send test alerts (6c1de144-056f-11ee-8e16-6c3be5272acd)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6c1de144-056f-11ee-8e16-6c3be5272acd advisory. - Grafana is an open-source platform for monitoring and observability. The option to send a test alert ...

Duplicate Advisory: Grafana Improper Access Control vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cvm3-pp2j-chr3. This link is maintained to preserve external references. Original Description Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available...

GHSA-WM7R-3QXJ-5XGQ Duplicate Advisory: Grafana Improper Access Control vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cvm3-pp2j-chr3. This link is maintained to preserve external references. Original Description Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available...

Design/Logic Flaw

Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access t...

KLA49378 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, obtain sensitive information, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Memory safety vulnerability can...

Unrestricted file upload

Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application Documentary proof upload modules allows a malicious user to Upload a Web Shell to a Web Server.This issue affects Mobatime web application: through 06.7.22...

KLA49284 Multiple vulnerabilities in Apple iTunes

An elevation of privilege vulnerabilities were found in Apple iTunes. Malicious users can exploit these vulnerabilities to gain privileges. Original advisories About the security content of iTunes 12.12.9 for Windows Exploitation Malware exists for this vulnerability. Usually such malware is...

wxETH.sol Inflation Attack

Lines of code Vulnerability details Impact The first staker may suffer an Inflation Attack and lose the funds Proof of Concept Currently wxETH still has the common ERC4626 'Inflation Attack' malicious users can front-run the first staker, raise exchange rates through donations, then achieve...

teampass vulnerable to code injection

In nilsteampassnet/teampass prior to 3.0.7, if two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a for...

Stored HTML Injection in Item Label

Description If two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a form. Proof of Concept...

KLA48970 Multiple vulnerabilities in Oracle Java SE and GraalVM

Multiple vulnerabilities were found in Oracle Java SE and GraalVM. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, cause denial of service. Below is a complete list of vulnerabilities: 1. Code execution vulnerability in Networking can be...

KLA48959 SB vulnerability in Microsoft System Center

A security feature bypass vulnerability was found in Microsoft System Center. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories CVE-2023-24934 Related products Windows-Defender CVE list CVE-2023-24934 high KB list Solution Install necessary update...