231583 matches found
Cross site scripting
IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM...
CVE-2024-1356
CVE-2024-1356 affects ArubaOS CLI: authenticated command injection that allows executing arbitrary commands as a privileged OS user. Affected ArubaOS versions per the connected Nessus/Red Hat advisories include ArubaOS < 8.10.0.10, < 8.11.2.1, < 10.4.1.0, and
CVE-2022-22399
IBM Aspera Faspex 5.0.0 and 5.0.1 are affected by an HTTP header injection flaw caused by improper validation of the HOST header. The vulnerability can enable cross‑site scripting, cache poisoning, or session hijacking against vulnerable installations. Affected products: IBM Aspera Faspex 5.0.0 a...
CVE-2023-25681
IBM Spectrum Virtualize 8.5 (CVE-2023-25681) permits LDAP-authenticated users configured for MFA to access the CIM interface using only a username and password, bypassing MFA. The issue affects CIM authentication and does not apply to local MFA users or SSO-enabled remote users. Red Hat and CVE l...
CVE-2023-26282
CVE-2023-26282 affects IBM Watson CP4D Data Stores versions 4.6.0–4.6.3. The root cause is a security flaw that could allow a user with physical access and system-specific knowledge to modify files or data on the system. Impact, as described in sources, is the possibility to modify files/data wit...
CVE-2024-23243
CVE-2024-23243 affects Apple iOS 17.4 and iPadOS 17.4, describing a privacy issue where an app may read sensitive location information due to insufficient private data redaction in log entries. Apple fixes are in iOS 17.4 / iPadOS 17.4. Remediation: update to these versions. Practical impact: lim...
CVE-2024-23225
CVE-2024-23225 is a memory-corruption vulnerability in Apple’s kernel that could allow an attacker with local access and kernel read/write capabilities to bypass kernel memory protections. The issue is addressed by patches in iOS 16.7.6 / iPadOS 16.7.6 and iOS 17.4 / iPadOS 17.4. Apple’s advisory...
CVE-2024-2056
CVE-2024-2056 — Artica Proxy Tailon exposure : Connected sources confirm that Artica Proxy runs a tailon service bound to the loopback interface and listening on TCP 7050. The tailon instance is running as root and is accessible via the proxy service, allowing an attacker to view files on the Art...
CVE-2024-2055
The Artica Proxy vulnerability CVE-2024-2055 involves the Rich Filemanager feature. When enabled, it does not require authentication and runs as root, exposing an unauthenticated web interface on port 5000/tcp. An attacker can gain complete filesystem access and could modify critical files (e.g.,...
CVE-2024-2054
CVE-2024-2054 affects Artica Proxy (administrative web app). Multiple connected sources confirm an unauthenticated PHP object deserialization flaw that enables remote code execution as the www-data user. Public materials describe exploitable behavior via deserialization in Artica Proxy versions a...
CVE-2024-2053
CVE-2024-2053 — Artica Proxy Unauthenticated LFI : The Artica Proxy administrative web app (versions 4.40/4.50) contains a local file inclusion flaw in the images.listener.php endpoint that bypasses attempted path-traversal protections. An unauthenticated attacker can cause the server to disclose...
CVE-2023-35899
CVE-2023-35899 affects IBM Cloud Pak for Automation versions 18.0.0 through 22.0.2. The issue is a CSV injection vulnerability caused by improper validation of CSV file contents, enabling a remote attacker to execute arbitrary commands on the system. Affected products/versions (per sources) inclu...
Double free
VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the...
CVE-2024-22254
CVE-2024-22254 : VMware ESXi contains an out-of-bounds write vulnerability in the VMX sandbox process. A local, privileged attacker within a VMX context could trigger the write and escape the sandbox, potentially impacting the host. Public details confirm the issue affects ESXi (and related VMwar...
CVE-2024-22253
CVE-2024-22253 is a use-after-free in the UHCI USB controller affecting VMware ESXi, Workstation, and Fusion. A malicious actor with local VM admin privileges can exploit it to execute code as the VMX process on the host; on ESXi this is contained within the VMX sandbox, while Workstation/Fusion ...
CVE-2024-22252
Summary of CVE-2024-22252 : VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges inside a VM can exploit this to execute code as the VMX process on the host; on ESXi the effect is contained w...
Server side request forgery (ssrf)
A Server-Side Request Forgery SSRF in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary requests...
CVE-2024-27931
CVE-2024-27931 concerns Deno, a JavaScript/TypeScript runtime. The issue is insufficient validation of parameters in the Deno.makeTemp* APIs, which can allow a user to create files outside of the intended directories via path traversal in the provided prefix/suffix. The documented impact is poten...