CVE-2023-47131

The CVE-2023-47131 issue affects the N-able PassPortal Chrome extension and is caused by the extension inserting sensitive information into log files in versions prior to 3.29.2. The impact is sensitive data disclosed via logs (as stated across Red Hat, NVD, CVE lists). Remediation is to upgrade ...

CVE-2024-24017

The data shows a SQL injection vulnerability in Novel-Plus v4.3.0-RC1 and earlier, exploitable via crafted offset, limit, and sort parameters to /common/dict/list. Affected component is the API endpoint handling dictionary/list operations; root cause is improper handling of user-supplied paginati...

Design/Logic Flaw

An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL vulnerabilitiesCountByDay...

CVE-2024-1066

CVE-2024-1066 affects GitLab EE and allows resource exhaustion via GraphQL vulnerabilitiesCountByDay. Affected are GitLab EE versions: 13.3.0 up to but not including 16.6.7, 16.7 up to but not including 16.7.5, and 16.8 up to but not including 16.8.2. The underlying issue is a lack of throttling/...

CVE-2023-6536

CVE-2023-6536 is a Linux kernel NVMe over TCP issue. The connected documents confirm a NULL pointer dereference in the NVMe target (nvmet_tcp_build_iovec and related paths) that could cause a kernel panic and denial of service. Affected software is the Linux kernel’s NVMe over TCP stack (nvmet_tc...

CVE-2023-6535

CVE-2023-6535 affects the Linux kernel NVMe driver. A crafted TCP packet sequence over NVMe over TCP may cause a NULL pointer dereference in the NVMe driver, leading to a kernel panic and denial of service. Connected documents confirm the same vulnerability text and its presence in multiple advis...

CVE-2023-6356

CVE-2023-6356 is a Linux kernel vulnerability in the NVMe driver affecting NVMe over TCP. The connected Nessus entries enumerate the issue as a NULL pointer dereference in the NVMe target path (nvmet_tcp_build_iovec/nvmet_tcp_execute_request/__nvmet_req_complete), which can lead to kernel panic a...

Information disclosure

An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password component...

Command injection

An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Input validation

Improper privilege control for the named pipe in Samsung Magician PC Software 8.0.0 for Windows allows a local attacker to read privileged data...

Cross site scripting

Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-existing session could be used to gain...

Code injection

IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure protocols in some instances that could allow an attacker on the network to take control of the server. IBM X-Force Id: 254957...

Default configuration

Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys...

Cross site request forgery (csrf)

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an unauthenticated, remote attacker to conduct cross-site request forgery CSRF attacks that perform arbitrary actions on an affected device. Note: "Cisco Expressway Series" refers...

Design/Logic Flaw

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an int as an index for an array. The typechecker allows the usage of...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Forum One WP-CFM wp-cfm.This issue affects WP-CFM: from n/a through 1.7.8...

Design/Logic Flaw

IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.6 products could allow a remote attacker to spoof a trusted system that would not be correctly validated by the Storwize server. This could lead to a user connecting to a malicious host, believing that it was a...

CVE-2024-24706

CVE-2024-24706 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Forum One WP-CFM plugin for WordPress (wp-cfm) affecting version 1.7.8 and earlier. The root cause is CSRF in WP-CFM that allows unauthorized actions to be performed on behalf of an authenticated user without their ...

CVE-2024-23806

CVE-2024-23806 targets HID iCLASS SE reader configuration cards and related devices. The vulnerability is described as Improper Authorization (CWE-285) and can allow reading sensitive data from the configuration cards, including credential and device administrator keys. Affected products include ...