CVE-2023-2332

CVE-2023-2332 is a stored XSS in pimcore/pimcore 10.5.19, located in the Conditions tab of Pricing Rules (Date Range From/To fields). The underlying issue allows injection of arbitrary JavaScript, potentially compromising user cookies or redirecting users. The vulnerability is mitigated by upgrad...

CVE-2023-4134

The CVE-2023-4134 issue affects the Linux kernel cyttsp4_core driver. A use-after-free occurs in the device cleanup routine due to a possible rearming of the watchdog_timer from the workqueue, enabling a local attacker to crash the system and cause a denial of service. The provided documents cons...

CVE-2023-34049

The CVE-2023-34049 issue concerns Salt's Salt-SSH pre-flight: the pre-flight script is copied to a predictable path on the target. If an attacker can access the target VM and knows that path before execution, they can force Salt-SSH to run their script with the privileges of the Salt-SSH user. Th...

CVE-2024-4741

CVE-2024-4741 affects OpenSSL when applications directly call SSL_free_buffers to free internal buffers for processing network records. The issue is a use-after-free: in two scenarios, the buffer is freed while still in use (during partial record processing or when only part of a record is read),...

CVE-2023-1932

CVE-2023-1932 involves a vulnerability in Hibernate Validator’s SafeHtmlValidator.isValid method. The flaw can be bypassed by omitting a tag ending in a less-than character, allowing browsers to render invalid HTML and potentially enabling HTML injection or Cross-Site Scripting (XSS). The entry s...

Debian: Security Advisory (DLA-3945-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7088-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for gdb (EulerOS-SA-2024-2665)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

BIT-GRAFANA-2023-5122 SSRF in CSV Datasource Plugin

Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests t...

CVE-2023-50310

CVE-2023-50310 affects IBM CICS Transaction Gateway for Multiplatforms (versions 9.2 and 9.3). The vulnerability arises from transmitting or storing authentication credentials using an insecure method, enabling potential interception or retrieval. Connected sources confirm affected products and p...

openSUSE: Security Advisory for the Linux Kernel (Live Patch 13 for SLE 15 SP5) (SUSE-SU-2024:3701-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for the Linux Kernel (Live Patch 40 for SLE 15 SP3) (SUSE-SU-2024:3690-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-22029

CVE-2024-22029 concerns insecure permissions in the packaging of Tomcat, enabling local privilege escalation for a race-condition during package installation. The connected advisories describe affected Tomcat packaging and note that patches/fixed packages are released by vendors (SUSE/OpenSUSE, D...

CVE-2023-32194

CVE-2023-32194 affects Rancher. The vulnerability arises when granting a create or * global role for the resource type "namespaces" across any API group, inadvertently giving the subject edit permissions on core namespaces and enabling access to create, update, or delete namespaces in a project. ...

CVE-2023-32193

CVE-2023-32193 corresponds to unauthenticated XSS in Rancher’s Norman public API endpoint (public API of rancher/norman). Root cause indicated by sources is insufficient input/URL validation in the API parsing (ParseRequestURL), enabling an attacker to inject/script and potentially execute comman...

CVE-2023-32192

The CVE-2023-32192 issue affects Rancher API Server (apiserver). Reported as an unauthenticated Cross-Site Scripting (XSS) vulnerability in the public API endpoint. Root cause described in connected sources as improper URL handling in ParseRequestURL within the apiserver, enabling arbitrary JavaS...

CVE-2023-32188

CVE-2023-32188 affects NeuVector. The issue arises from the ability to reverse‑engineer the JWT token used for Manager/API authentication, forging a valid token that can lead to remote code execution. This is described with a CVSS 4.0 base score of 9.4 (CRITICAL) and a network attack vector with ...

CVE-2023-22649

Summary of CVE-2023-22649 (Rancher Audit Log leak) A vulnerability in Rancher Audit Logging may leak sensitive data into audit logs. Affected deployments are those using the opt-in Audit Logging feature with AUDIT_LEVEL set to 1 or higher. The issue could expose headers, credentials, and other se...

Exploit for Code Injection in Sqlpad

CVE-2022-0944 PoC PoC for RCE in SQLPad. This example spawns a...

CVE-2023-37154

CVE-2023-37154 affects Nagios nagios-plugins 2.4.5, where check_by_ssh allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with ${IFS}. The issue is noted as categorized both as fixed in commit e8810de and as intended behavior; exploitation details are not pr...