The vulnerability of the IBM Security Directory Server software lies in the lack of encryption for confidential data, which allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the IBM Security Directory Server data storage and management software is related to the lack of encryption for confidential data. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...

GHSA-F798-QM4R-23R5 MLflow allowed arbitrary files to be PUT onto the server

MLflow allowed arbitrary files to be PUT onto the server...

Authentication flaw

An attacker can overwrite any file on the server hosting MLflow without any authentication...

PT-2023-8560 · Unknown · Weston Embedded Uc-Http

Name of the Vulnerable Software and Affected Versions: Weston Embedded uC-HTTP version 3.01.01 Description: A memory corruption issue exists in the HTTP Server Host header parsing functionality. This can be triggered by a specially crafted network packet, potentially leading to code execution. An...

PT-2023-7289 · Unknown · Weston Embedded Uc-Http

Name of the Vulnerable Software and Affected Versions: Weston Embedded uC-HTTP version 3.01.01 Description: A memory corruption issue exists in the HTTP Server form boundary functionality. This can be triggered by a specially crafted network packet, potentially leading to code execution. An...

The vulnerability of the DNS BIND server, related to the lack of use of the assert() function, allows a hacker to trigger a service failure.

The vulnerability of the DNS BIND server is related to the lack of use of the assert function. Exploiting this vulnerability allows a remote attacker to cause service failures...

CVE-2023-5950 Rapid7 Velociraptor Reflected XSS

This advisory covers a specific issue identified in Velociraptor and disclosed by a security code review. We want to thank Mathias Kujala for working with the Velociraptor team to identify and rectify this issue. It has been fixed as of Version 0.7.0-4, released November 6, 2023. CVSS · HIGH ·...

PT-2023-6867 · Unknown +1 · V-Server Lite +1

Name of the Vulnerable Software and Affected Versions: V-Server versions 4.0.18.0 and earlier V-Server Lite versions 4.0.18.0 and earlier Description: The issue is related to an out-of-bounds read vulnerability. This can be exploited by a remote attacker using a specially crafted file, potentiall...

PT-2023-6865 · Unknown +1 · V-Server Lite +1

Name of the Vulnerable Software and Affected Versions: V-Server versions 4.0.18.0 and earlier V-Server Lite versions 4.0.18.0 and earlier Description: The issue is related to heap-based buffer overflow vulnerabilities. Exploitation of this issue may allow a remote attacker to execute arbitrary co...

PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block

Impact When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing...

golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests

A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache...

Squid Code Problem Vulnerability

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A code issue vulnerability exists in versions prior to Squid 6.0.1 that stems from a NULL pointer dereference, which c...

The vulnerability of the IceWarp Server, related to the lack of measures taken to protect the structure of web pages, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the IceWarp Server web server is related to the lack of measures taken to protect the structure of the website. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2023-2621

The McFeeder server distributed as part of SSW package, is susceptible to an arbitrary file write vulnerability on the MAIN computer system. This vulnerability stems from the use of an outdated version of a third-party library, which is used to extract archives uploaded to McFeeder server. An...

SUSE CVE-2020-2765

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

SUSE CVE-2020-14586

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

SUSE CVE-2020-14678

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

SUSE CVE-2020-14800

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Encryption. Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...

SUSE CVE-2020-14828

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

SUSE CVE-2021-2072

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...