CVE-2023-31485

GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks...

CVE-2023-31485

GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks...

Code injection

GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks...

CVE-2023-31485

CVE-2023-31485 affects GitLab::API::v4 up to 0.26, which does not verify TLS certificates when connecting to a GitLab server, enabling potential machine-in-the-middle attacks. The Red Hat entry corroborates this description. The connected documents provide the vulnerability summary and affected c...

CVE-2023-31485

GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks...

GO-2023-1681 Time-of-check time-of-use race condition in github.com/containers/podman/v4

A Time-of-check Time-of-use TOCTOU flaw appears in this version of podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system...

GHSA-7J98-H7FP-4VWJ smarty Cross-site Scripting vulnerability in Javascript escaping

Impact An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the...

smarty Cross-site Scripting vulnerability in Javascript escaping

Impact An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the...

PT-2023-20229

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1 Description TensorFlow is an open source platform for machine learning. Attackers using TensorFlow can access heap memory which is not in the control of the user, leading ...

GHSA-6Q4M-7476-932W github-slug-action vulnerable to arbitrary code execution

Impact This action uses the github.headref parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. Note that...

CVE-2022-27672

A flaw was found in HW. When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch, potentially resulting in information disclosure. Mitigation The current mitigations for spectre V4 or spectrev2 should mitiga...

SUSE CVE-2021-33033

The Linux kernel before 5.11.14 has a use-after-free in cipsov4genopt in net/ipv4/cipsoipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value...

SUSE CVE-2021-45387

tcpreplay 4.3.4 has a Reachable Assertion in addtreeipv4 at tree.c...

KASAGO IPv6/v4 Dual 安全特征问题漏洞

KASAGO IPv6/v4 Dual is KASAGO's protocol middleware for TCP/IP communication. A security vulnerability exists in KASAGO IPv6/v4 Dual that stems from an insufficiently randomized ISN Initial Sequence Number. An attacker can exploit this vulnerability to predict the value of the ISN...

Malicious Package

Overview bootstrap-v4 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Weak password vulnerability in TOTOLINK N300RH V4

The TOTOLINK N300RH V4 is a wireless router. The TOTOLINK N300RH V4 suffers from a weak password vulnerability that can be exploited by attackers to obtain sensitive information...

GO-2022-1159 Path traversal in github.com/containers/podman/v4

The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality...

CVE-2022-45942

A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...

Remote code execution

A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...

PT-2022-27696 · Baijiacms · Baijiacms

Name of the Vulnerable Software and Affected Versions: baijiacms version v4 Description: A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php. Recommendations: For baijiacms version v4, consider restricting access to the includes/baijiacms/common.inc.php file...