PT-2023-13447 · Openbmc · Openbmc

Name of the Vulnerable Software and Affected Versions: OpenBMC versions prior to 0.72 Description: The issue is an out of bounds read in the firmware for OpenBMC in some Intel platforms, which may allow an unauthenticated user to potentially enable denial of service via network access...

PT-2023-13326 · Intel · Intel Sur

Name of the Vulnerable Software and Affected Versions: IntelR SUR software versions prior to 2.4.8902 Description: The issue is related to improper authentication, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For versions...

CVE-2022-27890

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

PT-2023-12923 · Palantir · Palantir Gotham

Name of the Vulnerable Software and Affected Versions: Palantir Gotham versions prior to 3.22.11.2 Description: The issue concerns an unauthenticated endpoint that loads portions of maliciously crafted zip files to memory. An attacker could exploit this by repeatedly uploading a malicious zip fil...

PT-2023-16567

Name of the Vulnerable Software and Affected Versions modoboa/modoboa-installer versions prior to 2.0.4 Description The issue is related to improper restriction of excessive authentication attempts. This can potentially lead to exploitation. Recommendations For versions prior to 2.0.4, update to...

PT-2023-12858 · Intel · Intel Trace Analyzer/Collector

Name of the Vulnerable Software and Affected Versions: IntelR Trace Analyzer and Collector versions prior to 2021.6 for IntelR oneAPI HPC Toolkit Description: The issue is related to an uncontrolled search path element in the IntelR Trace Analyzer and Collector, which may allow an authenticated...

PT-2023-1606 · Fortinet · Fortiproxy +2

Name of the Vulnerable Software and Affected Versions: FortiOS versions 6.4.10 and earlier, 7.0.0 through 7.0.8, 7.2.0 through 7.2.2 FortiProxy versions 2.0.10 and earlier, 7.0.0 through 7.0.7, 7.2.0 through 7.2.1 FortiSwitchManager versions 7.0.0 and earlier, 7.2.0 Description: A relative path...

PT-2023-3053 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 7.0.0 through 7.0.3 Description: The issue is related to a double free in the software, which may allow an attacker to execute unauthorized code or commands via specially crafted commands. This can potentially enable an...

SUSE CVE-2020-5236

Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and...

SUSE CVE-2021-21350

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to set...

SUSE CVE-2021-43797

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fa...

SUSE CVE-2022-1941

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of...

SUSE CVE-2022-24706

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front o...

SUSE CVE-2022-24836

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri = 1.13.4. There are no known workarounds for this issue...

SUSE CVE-2022-39957

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

SUSE CVE-2022-42896

There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2capcore.c's l2capconnect and l2capleconnectreq functions which may allow code execution and leaking kernel memory respectively remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via...

PT-2023-2032 · Hashicorp +1 · Hashicorp Nomad +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise versions 1.2.15 through 1.3.8 HashiCorp Nomad and Nomad Enterprise version 1.4.3 Description: The issue is related to excessive disk usage caused by a maliciously compressed artifact stanza source in jobs...

PT-2023-2270 · Solarwinds · Solarwinds Server/Application Monitor

Name of the Vulnerable Software and Affected Versions: Solarwinds Server & Application Monitor affected versions not specified Description: The issue is related to weaknesses in the authentication procedure, allowing a remote attacker to bypass authentication and access confidential information...

PT-2023-11538 · Kevinpapst · Kimai2

Name of the Vulnerable Software and Affected Versions: kevinpapst kimai2 version 1.30.0 Description: The issue is related to a Cross Site Scripting XSS vulnerability, which allows attackers to gain escalated privileges. This vulnerability is located in the /src/Twig/Runtime/MarkdownExtension.php...

B&R Systems Diagnostics Manager Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple XSS Vulnerabilities product: B&R Systems Diagnostics Manager vulnerable version: =3.00 and =D4.93 CVE number: CVE-2022-4286 impact: medium homepage:...