Design/Logic Flaw

Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...

UBUNTU-CVE-2023-5548

Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...

CVE-2023-5548 Moodle: cache poisoning risk with endpoint revision numbers

Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...

CVE-2023-5548 Moodle: cache poisoning risk with endpoint revision numbers

Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...

CVE-2023-5548

CVE-2023-5548 describes a Moodle-related issue where stronger revision number limitations on file serving endpoints are required to improve cache poisoning protection. The linked OSV/GHSA entries reiterate this root cause, framing it as a risk tied to how file endpoints handle revision data. The ...

PT-2023-32169 · Moodle +7 · Moodle +3

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves the need for stronger revision number limitations on file serving endpoints to enhance cache poisoning protection. This is a measure ...

CVE-2023-46136 vulnerabilities

Vulnerabilities for packages: airflow-core, kubeflow-volumes-web-app, py3-werkzeug, py3-tensorflow-serving-api, kubeflow-pipelines-visualization-server, airflow, kubeflow-jupyter-web-app...

GHSA-HRFV-MQP8-Q5RW vulnerabilities

Vulnerabilities for packages: airflow-core, kubeflow-volumes-web-app, py3-werkzeug, py3-tensorflow-serving-api, kubeflow-pipelines-visualization-server, airflow, kubeflow-jupyter-web-app...

Moodle < 3.9.24, 3.11.x < 3.11.17, 4.0.x < 4.0.11, 4.1.x < 4.1.6, 4.2.x < 4.2.3 Multiple Vulnerabilities

Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

GHSA-H454-RQ3M-89RC Wagtail CRX CodeRed Extensions vulnerable to Path Traversal

views.py in Wagtail CRX CodeRed Extensions formerly CodeRed CMS or coderedcms before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media...

GHSA-G4MX-Q9VG-27P4 vulnerabilities

Vulnerabilities for packages: kubeflow-volumes-web-app, k8s-sidecar, nvidia-nsight-compute-13.1, py3-cassandra-medusa, py3-pipenv, py3-tensorflow-serving-api, az, request-1276, kubeflow-katib, nvidia-nsight-compute-13.2, py3.13-scanner-test-libraries, kubeflow-jupyter-web-app, jwt-tool...

GHSA-G4MX-Q9VG-27P4 vulnerabilities

Vulnerabilities for packages: py3-tensorflow-serving-api, az, kubeflow-volumes-web-app, py3-pipenv, jwt-tool, kubeflow-jupyter-web-app, py3-cassandra-medusa, kubeflow-katib...

CVE-2023-45803 vulnerabilities

Vulnerabilities for packages: kubeflow-volumes-web-app, k8s-sidecar, nvidia-nsight-compute-13.1, py3-cassandra-medusa, py3-pipenv, py3-tensorflow-serving-api, az, request-1276, kubeflow-katib, nvidia-nsight-compute-13.2, py3.13-scanner-test-libraries, kubeflow-jupyter-web-app, jwt-tool...

CVE-2023-45803 vulnerabilities

Vulnerabilities for packages: py3-tensorflow-serving-api, az, kubeflow-volumes-web-app, py3-pipenv, jwt-tool, kubeflow-jupyter-web-app, py3-cassandra-medusa, kubeflow-katib...

CVE-2023-3656

cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network...

CVE-2023-3655

The CVE-2023-3655 entry concerns cashIT! - serving solutions on devices running version 03.A06rks 2023.02.37. Connected PT-2023-25621 details indicate the vulnerability allows leakage of the database (including system settings and user accounts) via an HTTP endpoint exposed to the network. No exp...

CVE-2023-3656

CVE-2023-3656 affects cashIT! – serving solutions from PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH. The vulnerability is an unauthenticated remote code execution triggered by an exposed HTTP endpoint. Affected versions are up to 03.A06rks 2023.02.37. The CVSS v3.1 score is 9.8 (CRITICAL), wi...

CVE-2023-43654

CVE-2023-43654 affects PyTorch TorchServe: default configuration allows input validation bypass, enabling SSRF via remote HTTP downloads and writing files to disk. Affected versions are 0.1.0 through 0.8.1; upgrading to TorchServe 0.8.2 mitigates the issue as the default behavior was changed to w...

Revive Adserver 跨站脚本漏洞

Revive Adserver is an open source ad serving system that allows advertisers, publishers, and networks to place ads on multiple platforms e.g., websites, apps, video players and supports ad effectiveness tracking, campaign management, and placement rule definition. Revive Adserver suffers from a...

CVE-2023-29401

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of...