Fedora: Security Advisory (FEDORA-2023-1185eca900)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

osCommerce Cross-Site Scripting Vulnerability

osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license. osCommerce suffers from a cross-site scripting vulnerability that stems from susceptibility to a cross-site scripting XSS vulnerability that allows an attacker to execute unauthorized scripts in a user's...

osCommerce Cross-Site Scripting Vulnerability

osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license. osCommerce suffers from a cross-site scripting vulnerability that stems from susceptibility to a cross-site scripting XSS vulnerability that allows an attacker to execute unauthorized scripts in a user's...

SUSE CVE-2023-5174

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only affects Firefox on Windows when run in non-standard configurations such as using runas...

VulnCheck KEV: CVE-2023-20109

Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN GET VPN feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash...

Apache Airflow Authorization Problem Vulnerability (CNVD-2023-72233)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow versions prior to 2.7.1 have an authorization issue vulnerability th...

PT-2023-31438 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.12 through 16.2.7 GitLab versions 16.3 through 16.3.4 Description: A critical vulnerability in GitLab allows attackers to run pipelines as other users, potentially granting access to internal repositories and closed project...

PT-2023-31529 · Openrapid · Openrapid Rapidcms

Name of the Vulnerable Software and Affected Versions: OpenRapid RapidCMS version 1.3.1 Description: A critical issue affects some unknown functionality of the file /admin/article/article-edit-run.php, where the manipulation of the id argument leads to SQL injection. This issue can be exploited...

OpenRapid RapidCMS SQL Injection Vulnerability

OpenRapid RapidCMS is OpenRapid open source a fast and easy to use CMS system. OpenRapid RapidCMS version 1.3.1 SQL injection vulnerability , the vulnerability stems from the file /admin/article/article-edit-run.php SQL injection vulnerability...

OpenRapid RapidCMS SQL Injection Vulnerability

OpenRapid RapidCMS is OpenRapid open source a fast and easy to use CMS system. RapidCMS version 1.3.1 SQL injection vulnerability , the vulnerability stems from the file admin/category/cate-edit-run.php SQL injection vulnerability...

PT-2023-31531 · Openrapid · Openrapid Rapidcms

Name of the Vulnerable Software and Affected Versions: OpenRapid RapidCMS version 1.3.1 Description: A critical issue has been discovered, affecting the file /admin/category/cate-edit-run.php. The manipulation of the id argument leads to SQL injection, allowing for remote attacks. Recommendations...

Incorrect Authorization

apacheairflow is vulnerable to Incorrect Authorization. The vulnerability is caused by a missing read only validation rule for all the fields e.g: startdate, enddate, runid ,dagid, state except note field while editing/modifying DAG Directed Acyclic Graph run detail values. This can lead to...

PT-2023-32964 · Unknown +3 · Isolated-Vm +3

Name of the Vulnerable Software and Affected Versions: vm2 versions up to 3.9.19 Directus versions prior to 10.6.0 Description: The issue allows attackers to bypass Promise handler sanitization in vm2, enabling them to escape the sandbox and execute arbitrary code. This specifically affects the...

CVE-2023-38891

SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRun.php...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Sep 2023)

This host is missing a critical security update according to Microsoft Office Click-to-Run update September 2023 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Improper input validation leads to arbitrary file deletion

Description The /process endpoint of the python API in collector/api.py exposes an endpoint waiting for a POST request with a parameter named filename : py @api.route"/process", methods="POST" def processfile: content = request.json targetfilename = content.get"filename" printf"Processing...

Internet Bug Bounty: CVE-2023-40611: Apache Airflow Dag Runs Broken Access Control Vulnerability

A vulnerability was found that allowed unauthorized modification of details in Apache Airflow dag runs. Users with dag view authorization could alter configuration parameters and start dates in some dag run details by modifying values when submitting notes. This issue was addressed in Apache...

PYSEC-2023-170

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allowsauthenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.Users should upgrade to...

Design/Logic Flaw

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to...

PYSEC-2023-170

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to...