CVE-2023-47707

IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

PT-2023-29653 · Hcl · Hcl Launch

Name of the Vulnerable Software and Affected Versions: HCL Launch affected versions not specified Description: The issue allows a user to embed arbitrary HTML tags in the Web UI, potentially leading to sensitive information disclosure. This is due to an HTML injection vulnerability...

CVE-2023-42015

IBM UrbanCode Deploy UCD 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure. IBM X-Force ID: 265512...

PT-2023-7937

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 115.6 Firefox versions prior to 121 Description The issue is related to the timing of a button click causing a popup to disappear, which is approximately the same length as the anti-clickjacking delay on permissio...

IBM Security Guardium Cross-Site Scripting Vulnerability

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as customizable UI, report management, and streamlined audit process building. A cross-site scripting vulnerability exists in IBM...

Windows DPAPI Spoofing

The vulnerability of Windows DPAPI on the Windows operating system is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spoofing attacks...

Azure DevOps Server XSS

The vulnerability of Azure DevOps Server relates to errors in information presentation by the user interface. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions and perform cross-site scripting attacks...

KLA62518 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, inject malicious code, execute arbitrary code, obtain sensitive information, spoof user interface, cause denial of service. Below is a complete list of...

KLA62519 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, cause denial of service, spoof user interface. Below is a complete list of vulnerabilities: 1. Security vulnerability in Symlinks...

KLA62517 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, execute arbitrary code, spoof user interface, cause denial of service. Below is a complete list of vulnerabilities: 1. Security...

IBM UrbanCode Deploy Security Vulnerabilities

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from International Business Machines IBM. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different...

Microsoft Office for Mac Spear Phishing

The vulnerability of the Microsoft Office for Mac software is related to information representation errors in the user interface. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks remotely...

Windows DNS Server Spoofing

The vulnerability of DNS servers in Windows operating systems is related to errors in information representation by the user interface. Exploiting this vulnerability can allow a malicious actor to perform spoofing attacks remotely...

Remote code execution from account through SearchAdmin

Impact The search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros including Groovy macros that allow remote code execution, impacting the confidentiality, integrity and...

GHSA-7654-VFH6-RW6X Remote code execution from account through SearchAdmin

Impact The search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros including Groovy macros that allow remote code execution, impacting the confidentiality, integrity and...

UBUNTU-CVE-2023-5512

An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading for incorrect...

PT-2023-32144 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.3 through 16.4.3 GitLab CE/EE versions 16.5 through 16.5.3 GitLab CE/EE versions 16.6 through 16.6.1 Description: An issue has been discovered in GitLab CE/EE where file integrity may be compromised when specific HTML...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from the fact that file...

CVE-2023-6563

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens 500,000 users with each having at least 2 saved sessions. If an attacker creates two or more user sessions and then open the "consents" tab of th...

CVE-2023-6563: Allocation of Resources Without Limits or Throttling

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens 500,000 users with each having at least 2 saved sessions. If an attacker creates two or more user sessions and then open the "consents" tab of th...