1380 matches found
CVE-2023-20060
CVE-2023-20060 relates to Cisco Prime Collaboration Deployment’s web-based management interface. The issue arises from improper validation of user-supplied input, enabling an unauthenticated, remote attacker to lure a user into clicking a crafted link and execute arbitrary script code in the inte...
CVE-2023-20092
Cisco TelePresence CE and RoomOS CLI have three local arbitrary file-write vulnerabilities (CVE-2023-20092) due to improper local file access controls. An authenticated, local attacker could place a symbolic link to overwrite arbitrary files; exploitation requires a remote support user account. A...
CVE-2023-20094
This CVE (CVE-2023-20094) affects Cisco TelePresence CE and Cisco RoomOS. The issue is caused by improper bounds checks in the affected software, enabling an unauthenticated, adjacent attacker to send a crafted request that can trigger an out-of-bounds read, potentially disclosing sensitive infor...
CVE-2024-20373
CVE-2024-20373 affects Cisco IOS and IOS XE SNMP IPv4 ACL handling. Root cause: extended IPv4 ACLs for SNMP aren’t supported, but extended named IPv4 ACLs can be attached to the SNMP server without warning, causing no ACL to be applied to SNMP listening. Impact: unauthenticated remote SNMP pollin...
CVE-2022-2232
CVE-2022-2232 concerns a LDAP injection in Keycloak’s username lookup, allowing bypass and potentially other actions. Affected: Keycloak package; root cause: LDAP injection during username lookup. Impact: high confidentiality risk; no user interaction required, network vector, privileges not requ...
CVE-2024-3447
A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both s-datacount and the size of s-fifobuffer are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a...
CVE-2022-31667
Harbor (the Harbor registry) is affected by CVE-2022-31667 due to improper authorization when updating a robot account. The issue occurs when a request to update a robot account specifies an account and name belonging to a project the authenticated user cannot access, allowing an attacker to revo...
CVE-2022-31669
Harbor (the open‑source registry) contains an authorization flaw in its tag immutability policy API. The vulnerability occurs when updating a tag immutability policy, where a request may specify a policy in a project the authenticated user cannot access, enabling modification of policies in other...
CVE-2022-31666
Harbor vulnerability CVE-2022-31666 involves failure to validate user permissions when managing Webhook policies. The issue allows authenticated users to view, update, or delete Webhook policies belonging to other users or projects, potentially enabling modification of policies configured in othe...
CVE-2023-4134
The CVE-2023-4134 issue affects the Linux kernel cyttsp4_core driver. A use-after-free occurs in the device cleanup routine due to a possible rearming of the watchdog_timer from the workqueue, enabling a local attacker to crash the system and cause a denial of service. The provided documents cons...
CVE-2024-4741
Issue summary: Calling the OpenSSL API function SSLfreebuffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code...
CVE-2024-31880
CVE-2024-31880 : IBM Db2 for Linux, UNIX and Windows (incl. Db2 Connect Server) 10.5, 11.1, 11.5 is vulnerable to DoS under certain configurations when authenticated users send a crafted SQL statement, potentially crashing the server. Connected IBM bulletins/CPD advisories tie this set to IBM Db2...
CVE-2024-22032
CVE-2024-22032: Rancher’s RKE1 deployment keeps reconciling when secrets encryption is enabled, causing Kube API secret values to be written in plaintext in the cluster AppliedSpec. Affected environments include RKE1 clusters managed by Rancher; RBAC users with cluster or project scope can view t...
CVE-2024-22029
Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root...
CVE-2023-32196
CVE-2023-32196 describes an privilege-escalation risk in Rancher where RoleTemplate objects with external=true may bypass checks, enabling escalation in specific scenarios. The issue affects Rancher/Rancher Manager components that manage RoleTemplate resources (CRD-backed objects) and is tied to ...
CVE-2023-32193
CVE-2023-32193 corresponds to unauthenticated XSS in Rancher’s Norman public API endpoint (public API of rancher/norman). Root cause indicated by sources is insufficient input/URL validation in the API parsing (ParseRequestURL), enabling an attacker to inject/script and potentially execute comman...
CVE-2023-32192
The CVE-2023-32192 issue affects Rancher API Server (apiserver). Reported as an unauthenticated Cross-Site Scripting (XSS) vulnerability in the public API endpoint. Root cause described in connected sources as improper URL handling in ParseRequestURL within the apiserver, enabling arbitrary JavaS...
CVE-2023-22650
This CVE concerns Rancher not automatically cleaning up deleted/disabled users from the configured authentication provider, leaving tokens usable and potentially granting continued access. Concrete details from connected sources show the issue affects Rancher and involves user accounts that persi...
WordPress Plugin Jetpack Patches Major Vulnerability Affecting 27 Million Sites
The maintainers of the Jetpack WordPress plugin have released a security update to remediate a critical vulnerability that could allow logged-in users to access forms submitted by others on a site. Jetpack, owned by WordPress maker Automattic, is an all-in-one plugin that offers a comprehensive...