6010 matches found
CVE-2023-32194
CVE-2023-32194 affects Rancher. The vulnerability arises when granting a create or * global role for the resource type "namespaces" across any API group, inadvertently giving the subject edit permissions on core namespaces and enabling access to create, update, or delete namespaces in a project. ...
CVE-2023-32193
CVE-2023-32193 corresponds to unauthenticated XSS in Rancher’s Norman public API endpoint (public API of rancher/norman). Root cause indicated by sources is insufficient input/URL validation in the API parsing (ParseRequestURL), enabling an attacker to inject/script and potentially execute comman...
CVE-2023-32192
The CVE-2023-32192 issue affects Rancher API Server (apiserver). Reported as an unauthenticated Cross-Site Scripting (XSS) vulnerability in the public API endpoint. Root cause described in connected sources as improper URL handling in ParseRequestURL within the apiserver, enabling arbitrary JavaS...
CVE-2023-32191
The CVE-2023-32191 issue affects Rancher RKE: cluster state is stored in the full-cluster-state configmap in the kube-system namespace, containing sensitive credentials and keys (e.g., SSH keys, cloud provider credentials, encryption keys). This enables non-admin users to escalate to admin. Patch...
CVE-2023-22650
This CVE concerns Rancher not automatically cleaning up deleted/disabled users from the configured authentication provider, leaving tokens usable and potentially granting continued access. Concrete details from connected sources show the issue affects Rancher and involves user accounts that persi...
CVE-2023-22649
Summary of CVE-2023-22649 (Rancher Audit Log leak) A vulnerability in Rancher Audit Logging may leak sensitive data into audit logs. Affected deployments are those using the opt-in Audit Logging feature with AUDIT_LEVEL set to 1 or higher. The issue could expose headers, credentials, and other se...
Cross-site Scripting (XSS)
Krayin CRM is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input validation in the organization name field in /admin/contacts/organizations/edit/2, allowing malicious scripts to be injected...
CVE-2023-37154
checkbyssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with $IFS. This has been categorized both as fixed in e8810de, and as intended behavior...
CVE-2023-37154
CVE-2023-37154 affects Nagios nagios-plugins 2.4.5, where check_by_ssh allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with ${IFS}. The issue is noted as categorized both as fixed in commit e8810de and as intended behavior; exploitation details are not pr...
CVE-2023-45359
CVE-2023-45359 affects MediaWiki’s Vector Skin: vector-toc-toggle-button-label is not escaped, allowing markup in the line parameter. Affected: Vector Skin for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. Descriptions in connected docs do not provide exploitation details or a confirmed patch...
CVE-2023-45361
The CVE-2023-45361 issue affects MediaWiki’s Vector Skin (VectorComponentUserLinks.php) in versions prior to 1.39.5 and 1.40.x prior to 1.40.1. The root cause is that MalformedTitleException is uncaught when a vector-intro-page title is invalid, which can lead to incorrect web pages being produce...
CVE-2023-36325
CVE-2023-36325 affects i2p before 2.3.0 (Java). A correlation attack during a tunneled, replayed message with a behavior discrepancy can de-anonymize the public IPv4 and IPv6 addresses of i2p hidden services (eepsites). Impact is de-anonymization; attack would take days to complete. Affected vers...
CVE-2023-46586
The CVE affects the Weborf web server implementation (cgi.c) prior to version 1.0. The root cause is a misused strncpy that fails to terminate CGI script paths with a null character, leaving input paths unterminated. This impacts Weborf releases before 1.0 across reported versions (0.17–0.20). Pr...
Cross-site Scripting (XSS)
Overview krayin/laravel-crm is a hand tailored CRM framework built on some of the hottest opensource technologies such as Laravel a PHP framework and Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the organization name...
GHSA-74Q2-6JP4-3RQQ Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...
Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...
CVE-2024-45932
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...
CVE-2024-45932
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...
CVE-2024-45932
Krayin CRM v1.3.0 is affected by a Cross-Site Scripting (XSS) vulnerability in the organization name field of /admin/contacts/organizations/edit/2. The issue is caused by improper input validation/escaping, allowing attacker-supplied scripts to be reflected to users. Documentation from multiple s...