BELL-CVE-2023-48795

Bulletin has no description...

CVE-2023-50976

Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...

GO-2023-2400 Escalation of privileges in github.com/sap/cloud-security-client-go

An unauthenticated attacker can obtain arbitrary permissions within the application under certain conditions...

OSV-2023-1313 Heap-buffer-overflow in isvcd_start_of_pic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65060 Crash type: Heap-buffer-overflow WRITE Crash state: isvcdstartofpic isvcdparsedecodeslice isvcdparsenalunit...

Potential CSV export data leak

Impact In ActiveAdmin versions prior to 2.12.0, a concurrency issue was found that could allow a malicious actor to be able to access potentially private data that belongs to another user. The bug affects the functionality to export data as CSV files, and was caused by a variable holding the...

Path traversal in MLflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

BELL-CVE-2023-50471

Bulletin has no description...

Cross-site Scripting in JFinalcms

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting XSS in the site management office...

CVE-2023-6570 Server-Side Request Forgery (SSRF) in kubeflow/kubeflow

Server-Side Request Forgery SSRF in kubeflow/kubeflow...

CVE-2023-6569 External Control of File Name or Path in h2oai/h2o-3

External Control of File Name or Path in h2oai/h2o-3...

BELL-CVE-2023-6377

Bulletin has no description...

CVE-2023-49936

An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1...

PT-2023-31379 · WordPress · Soledad

Name of the Vulnerable Software and Affected Versions: Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme versions through 8.4.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for...

GHSA-3M87-5598-2V4F Withdrawn Advisory: Prometheus XSS Vulnerability

Withdrawn Advisory This advisory has been withdrawn because the vulnerability does not apply to the Prometheus golang package. This link is maintained to preserve external references. Original Description A stored, DOM based, cross-site scripting XSS flaw was found in Prometheus before version...

BELL-CVE-2023-50246

Bulletin has no description...

CVE-2023-50771

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...

GHSA-VPP3-HPCM-V944 Broken access control in Silverpeas

The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL...

Missing access control in Silverpeas

The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators...

CVE-2023-50495

NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component ncwrapentry...

CVE-2023-48431

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 2. Affected software does not correctly validate the response received by an UMC server. An attacker can use this to crash the affected software by providing and configuring a malicious UMC server or by manipulating the...