407 matches found
CVE-2024-0387 EDS-4000/G4000 Series IP Forwarding Vulnerability
The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests...
CVE-2024-0387 EDS-4000/G4000 Series IP Forwarding Vulnerability
The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests...
Fedora 39 : caddy (2024-22b915e51a)
The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-22b915e51a advisory. Update to the latest upstream version, which includes a fix for CVE-2023-45142. https://github.com/caddyserver/caddy/releases/tag/v2.7.6 Tenable has extracte...
XunRuiCMS Cross-Site Scripting Vulnerability (CNVD-2024-12713)
XunRuiCMS XunRui CMS is an open source content management system CMS. A cross-site scripting vulnerability exists in XunRuiCMS v4.6.2 and earlier versions. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by remo...
CVE-2024-24388
Cross-site scripting XSS vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious requests to the background login...
CVE-2024-24388
Cross-site scripting XSS vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious requests to the background login...
RHEL 8 : OpenShift Container Platform 4.12.48 (RHSA-2024:0489)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0489 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...
K000138255: Go OpenTelemetry Contrib vulnerability CVE-2023-47108
Security Advisory Description OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the...
Ivanti Connect Secure Policy Secure Arbitrary Command Execution
The vulnerability of the Web interfaces of Ivanti Connect Secure and Ivanti Policy Secure lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending...
Code injection
The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log...
Denial Of Service (DoS)
github.com/cubefs/cubefs is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of incoming HTTP requests in a CubeFS HandlerNode that could allow an authenticated users to send maliciously-crafted requests that would crash the ObjectNode. An attacker can send a...
GHSA-QC6V-G3XW-GRMX Authenticated users can crash the CubeFS servers with maliciously crafted requests
A security vulnerability was found in CubeFS HandlerNode that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cause was improper handling of incoming HTTP requests that could allow an attacker to...
CVE-2023-46738 Authenticated users can crash the CubeFS servers with maliciously crafted requests
CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cau...
CVE-2023-46738 Authenticated users can crash the CubeFS servers with maliciously crafted requests
CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cau...
PT-2023-31699
Name of the Vulnerable Software and Affected Versions InspireUI MStore API versions through 4.10.1 Description A Cross-Site Request Forgery CSRF issue affects the InspireUI MStore API. This issue allows for malicious requests to be made on behalf of a user without their knowledge or consent...
CVE-2023-51451
Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via...
CVE-2023-50705
An attacker could create malicious requests to obtain sensitive information about the web server...
CVE-2023-50705
An attacker could create malicious requests to obtain sensitive information about the web server...