Improper Path Sanitization in JSON Datasource Plugin

Grafana is an open-source platform for monitoring and observability. The JSON datasource plugin is a Grafana Labs maintained plugin that allows for retrieving and processing JSON data from a remote endpoint including a specific sub-path configured by an administrator. Due to inadequate sanitizati...

Grafana Code Issue Vulnerability

Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface . The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. Grafana has a security vulnerability that stems from a CSV datasource plugin that...

CVE-2023-51734

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Identity parameter under Remote endpoint settings at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to th...

Input validation

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Identity parameter under Remote endpoint settings at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to th...

CVE-2023-51734

CVE-2023-51734 affects Skyworth Router CM5100, version 4.1.1.24. The issue originates from insufficient validation of the Identity parameter in the web interface’s Remote endpoint settings, enabling a remote attacker to supply crafted input that can trigger a stored XSS vulnerability. The availab...

CVE-2023-51734 Stored Cross Site Scripting Vulnerability in Skyworth Router

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Identity parameter under Remote endpoint settings at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to th...

CVE-2023-51734 Stored Cross Site Scripting Vulnerability in Skyworth Router

This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to insufficient validation of user supplied input for the Identity parameter under Remote endpoint settings at its web interface. A remote attacker could exploit this vulnerability by supplying specially crafted input to th...

PT-2024-14273 · Skyworth · Skyworth Router Cm5100

Name of the Vulnerable Software and Affected Versions: Skyworth Router CM5100 version 4.1.1.24 Description: This issue exists due to insufficient validation of user-supplied input for the Identity parameter under Remote endpoint settings at the web interface. A remote attacker could exploit this ...

CVE-2023-30844 Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints

Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in mutagen and prior to version 0.17.1 in mutagen-compose, Mutagen list and monitor commands are susceptible to control characters that could be provided by remote...

Consul Service Mesh Intention Bypass with Malicious Certificate Signing Request

Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that a specially crafted CSR sent directly to Consul’s internal server agent RPC endpoint can include multiple SAN URI values with additional service names. This vulnerability, CVE-2022-40716, was fixed in Consul...

CVE-2021-38417

VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing...

CVE-2021-38417

VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing...

Improper access control

VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing...

CVE-2021-38417 VISAM VBASE Editor Improper Access Control

VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing...

Malicious Package

pygrata-utils is a malicious package. The library attempts to harvest and upload the AWS credentials, network interface information and environment variables to a remote endpoint: "hxxp://graph.pygrata.com:8000/upload."...

Palo Alto Networks Cortex XDR Information Disclosure Vulnerability

Palo Alto Networks Cortex XDR is a security operations platform for remote endpoint-based detection from Palo Alto Networks Malaysia. A security vulnerability exists in the Palo Alto Networks Cortex XDR agent that can be exploited by an attacker to read the contents of any file on the system with...

GLSA-202107-50 : Singularity: Remote code execution

The remote host is affected by the vulnerability described in GLSA-202107-50 Singularity: Remote code execution Singularity always uses the default remote endpoint, cloud.syslabs.io, for action commands using the library:// URI rather than the configured remote endpoint. Impact : An attacker that...

MGASA-2022-0006 Updated singularity packages fix security vulnerability

A dependency used to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." or "/", when running as root. CVE-2021-29136 Dde to incorrect use of a default URL, singularity action commands run/shell/exec specifyin...

Updated singularity packages fix security vulnerability

A dependency used to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." or "/", when running as root. CVE-2021-29136 Dde to incorrect use of a default URL, singularity action commands run/shell/exec specifyin...

Singularity: Remote code execution

Background Singularity is the container platform for performance sensitive workloads. Description Singularity always uses the default remote endpoint, ‘cloud.syslabs.io’, for action commands using the ‘library://’ URI rather than the configured remote endpoint. Impact An attacker that that can pu...