CVE-2023-3384

A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex validation.py, the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to...

CVE-2023-3384

A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex validation.py, the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to...

Cross site scripting

A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex validation.py, the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to...

CVE-2023-3384 Quay: stored cross site scripting

A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex validation.py, the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to...

The vulnerabilities of the Device Manager Server, Device Manager Agent, and Host Data Collector components of the Hitachi Device Manager system allow attackers to execute “man-in-the-middle” type attacks.

The vulnerability of the Device Manager Server, Device Manager Agent, and Host Data Collector components of the Hitachi Device Manager storage management system is related to an inconsistency in the host name due to incorrect validation of SSL/TLS certificates. Exploiting this vulnerability could...

PT-2023-7954 · D Link · D-Link G416

Name of the Vulnerable Software and Affected Versions: D-Link G416 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. The specific flaw exists within the HTTP service...

The vulnerability of the kubelet utility in the Kubernetes cluster management software allows a attacker to configure certain modules to operate in an “abnormal mode”.

The vulnerability of the kubelet utility in the Kubernetes cluster management software is related to insufficient validation of the specified type of input data. Exploiting this vulnerability could allow an attacker to configure certain modules to operate in a “non-organic mode”...

The vulnerability of the CPAN.pm component in the Perl programming language allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the CPAN.pm component in the Perl programming language is related to errors in the TLS certificate validation process. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

CVE-2023-34394

In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges due to an improper path validation, which could result in local privilege escalation or a denial-of-service condition...

CVE-2023-38430

An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read...

The vulnerability of the Failover Cluster component for Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Failover Cluster component for Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the USB Audio Class System driver for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the USB Audio Class System driver for Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the ActiveX components of Microsoft Office programs allows a perpetrator to execute arbitrary code on the target system.

The vulnerability of the ActiveX components of Microsoft Office programs is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code on the target system using the created file...

PT-2023-3700 · Oracle +1 · Oracle Web Applications Desktop Integrator +1

Name of the Vulnerable Software and Affected Versions: Oracle Web Applications Desktop Integrator versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the MS Excel Specific component of Oracle Web Applications Desktop Integrator, part of the Oracle...

PT-2023-3643 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.19 Oracle Database Server versions 21.3 through 21.10 Description: The issue is related to insufficient input validation in the Unified Audit component of Oracle Database Server. It allows a...

PT-2023-25343 · Mattermost · Mattermost Boards

Name of the Vulnerable Software and Affected Versions: Mattermost Boards affected versions not specified Description: The issue is related to the improper validation of a board link in Mattermost Boards, which allows an attacker to crash a channel by posting a specially crafted boards link...

Linux kernel 数字错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. An out-of-bounds read vulnerability exists in versions of Linux kernel prior to 6.3.8, which stems from a lack of input validation in deassemblenegcontexts in...

iperf3 输入验证错误漏洞

iperf3 is an ESnet open source tool for actively measuring the maximum bandwidth achievable on an IP network. A security vulnerability exists in iperf3 versions prior to 3.14. An attacker exploited the vulnerability to cause an integer overflow and heap corruption via a specially crafted length...

Mattermost 资源管理错误漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost Boards suffers from a security vulnerability that stems from not properly validating board links, allowing an attacker to crash the channel by posting a specially crafted link...

Online Piggery Management System Arbitrary File Upload Vulnerability

Online Piggery Management System is an online pig management system by Lewa Personal Developer. Online Piggery Management System v1.0 has an arbitrary file upload vulnerability, the vulnerability stems from the lack of effective validation of add-pig.php for uploaded files, which can be exploited...