PT-2023-23228 · Intel · Openvino Model Server

Name of the Vulnerable Software and Affected Versions: OpenVINO Model Server versions prior to 2022.3 Description: The issue is related to improper input validation in the OpenVINO Model Server software, which may allow an unauthenticated user to potentially enable denial of service via network...

RHEL 8 : java-21-openjdk (RHSA-2023:6887)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6887 advisory. The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fixe...

Zoom Client for Meetings < 5.16.0 Vulnerability (ZSB-23049)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.16.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-23049 advisory. - Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of...

MariaDB 11.0.0 < 11.0.4

The version of MariaDB installed on the remote host is prior to 11.0.4. It is, therefore, affected by a vulnerability as referenced in the 11.0.4 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.43 and prior,...

Zoom VDI Meeting Client < 5.16.0 Vulnerability (ZSB-23052)

The version of Zoom VDI Meeting Client installed on the remote host is prior to 5.16.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-23052 advisory. - Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information...

Zoom Client for Meetings < 5.16.0 Vulnerability (ZSB-23052)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.16.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-23052 advisory. - Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information...

MariaDB 10.11.0 < 10.11.6

The version of MariaDB installed on the remote host is prior to 10.11.6. It is, therefore, affected by a vulnerability as referenced in the 10.11.6 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.43 and prior,...

Zoom Client for Meetings < 5.16.0 Vulnerability (ZSB-23047)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.16.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-23047 advisory. - Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow a...

MariaDB -- Denial-of-Service vulnerability

The MariaDB project reports: Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash complete...

Exploit for Deserialization of Untrusted Data in Apache Activemq

CVE-2023-46604 RCE Pseudoshell This script leverages CVE-2023...

OESA-2023-1814 openjdk-latest security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u381-perf, 17.0.8, 21; Oracle GraalVM for JDK:...

PT-2023-27882 · Qumagie · Qumagie

Name of the Vulnerable Software and Affected Versions: QuMagie versions prior to 2.1.4 Description: A SQL injection issue has been reported, potentially allowing authenticated users to inject malicious code via a network. Recommendations: For versions prior to 2.1.4, update to QuMagie 2.1.4 or...

QNAP Systems QuMagie SQL Injection Vulnerability

QNAP Systems QuMagie is a QTS photo management application from QNAP Systems. A security vulnerability exists in QNAP Systems QuMagie version 2.1.3 and prior versions, which stems from the presence of a SQL injection vulnerability that could allow an authenticated user to inject malicious code ov...

SUSE CVE-2023-25775

Improper access control in the IntelR Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an unauthenticated user to potentially enable escalation of privilege via network access...

CVE-2023-20902

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information...

Design/Logic Flaw

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information...

CVE-2023-20902 Timing attack risk in Harbor

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information...

CVE-2023-20902

CVE-2023-20902 affects Harbor up to specific older branches: 2.6.x and below, 2.7.2 and below, 2.8.2 and below, and 1.10.17 and below. A timing condition in Harbor permits a remote attacker (network access) to create or stop job tasks and to retrieve job task information. No public details beyond...

CVE-2023-20902 Timing attack risk in Harbor

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information...

PT-2023-7670 · Unknown · Sentry-Javascript

Name of the Vulnerable Software and Affected Versions: sentry-javascript versions prior to 7.77.0 Description: The issue is related to insufficient input validation in the sentry-javascript SDK, specifically affecting the Next.js SDK tunnel endpoint. This allows an attacker to send HTTP requests ...