Design/Logic Flaw

An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the message function...

Cross site scripting

Cross Site Scripting XSS vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username and group name components...

Design/Logic Flaw

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates...

Design/Logic Flaw

When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a...

Design/Logic Flaw

An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component...

CVE-2024-24786

CVE-2024-24786 concerns protojson.Unmarshal entering an infinite loop when unmarshalling certain invalid JSON, notably into messages containing google.protobuf.Any or when UnmarshalOptions.DiscardUnknown is set. Connected advisories show multiple vendor/package records (e.g., kata-containers, mob...

CVE-2023-45289

CVE-2023-45289 concerns the Go net/http redirect handling: when following an HTTP redirect to a domain that is not a subdomain/exact match of the initial domain, sensitive headers (e.g., Authorization, Cookie) may be forwarded inappropriately. The connected advisories (e.g., ALAS2DOCKER-2024-045,...

CVE-2023-45290

The CVE-2023-45290 issue affects Go’s net/http form parsing: Request.ParseMultipartForm and related helpers can allocate memory for extremely long form lines, allowing memory exhaustion. A fix was issued to cap the maximum size of form lines during parsing of multipart forms. Connected sources (A...

CVE-2024-24783

CVE-2024-24783 is confirmed in multiple advisories tied to Go crypto/x509: certificates with an unknown public key algorithm can cause Certificate.Verify to panic in TLS verification. Affected products/areas include container-tools components (Go-based utilities such as net/http, x509 handling) a...

Design/Logic Flaw

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. The use...

CVE-2024-1900

This CVE affects Devolutions Server (versions up to 2023.3.14.0) where improper session management in the identity provider authentication flow can allow an authenticated user, validated via an external IdP (e.g., Okta or O365), to remain authenticated after their identity is disabled or deleted....

Command injection

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

Information disclosure

Aruba has identified certain configurations of ArubaOS that can lead to partial disclosure of sensitive information in the IKEAUTH negotiation process. The scenarios in which disclosure of potentially sensitive information can occur are complex, and depend on factors beyond the control of attacke...

Command injection

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2023-20907

CVE-2023-20907 is listed in the Android 14 security release notes as a high-severity DoS in the Framework component. The Android bulletin groups it among Framework vulnerabilities for Android 14, with reference A-239415997. The document does not provide specific affected product versions beyond A...

CVE-2024-25616

CVE-2024-25616 affects ArubaOS (Aruba Mobility Controllers/SD-WAN gateways). Certain configurations during the IKE_AUTH negotiation can cause partial disclosure of sensitive information. Affected software versions include ArubaOS 8.x prior to 8.10.0.10, 8.11 prior to 8.11.2.1, 10.4 prior to 10.4....

CVE-2024-25611

CVE-2024-25611 : ArubaOS contains authenticated command injection in its command-line interface. Exploitation lets an authenticated attacker execute arbitrary commands as a privileged OS user, with high impact to confidentiality, integrity, and availability. Affected ArubaOS versions include thos...

Design/Logic Flaw

Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. In particular, the "tailon" service is running, running as the root user, is bound to the loopback interface, and is listening on TCP port 7050. Security issues associated...

Default credentials

LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM interface using only username and password. This does not affect local users with MFA configured or remote users authenticating via single sign-on. IBM X-Force ID...

Memory corruption

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue...