PT-2023-21066 · Netapp · Ontap Mediator

Name of the Vulnerable Software and Affected Versions: ONTAP Mediator versions prior to 1.7 Description: The issue allows an unauthenticated attacker to enumerate URLs via the REST API. Recommendations: For versions prior to 1.7, update to version 1.7 or later to resolve the issue. As a temporary...

Cacti security breach

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to obtain data , using RRDtool drawing graphs to analyze , and provide data and user management features . A security vulnerability exists in Cacti versions prior to 1.2.26,...

PT-2023-32461

Name of the Vulnerable Software and Affected Versions LioXERP versions prior to 146 Description The issue affects LioXERP, allowing Reflected XSS due to improper neutralization of input during web page generation. This can lead to cross-site scripting attacks. Recommendations For versions prior t...

CVE-2023-6871

Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler. This vulnerability affects Firefox 121...

PT-2023-32753

Name of the Vulnerable Software and Affected Versions huggingface/transformers versions prior to 4.36.0 Description The issue is related to the deserialization of untrusted data in the huggingface/transformers GitHub repository. Recommendations For versions prior to 4.36.0, update to version 4.36...

Mozilla Firefox Security Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation. A security vulnerability exists in Mozilla Firefox prior to version 121, which stems from a Toast notification being generated in a background thread that obscures the full-screen notification displayed by Firefox...

PT-2023-32437 · WordPress · Smartcrawl

Name of the Vulnerable Software and Affected Versions: SmartCrawl WordPress plugin versions prior to 3.8.3 Description: The issue allows unauthorized users to access the content of password-protected posts. Recommendations: For versions prior to 3.8.3, update to version 3.8.3 or later to resolve...

ClearML Server Cross-Site Scripting Vulnerability

ClearML Server is an open source suite of tools from ClearML that simplifies machine learning workflows. A cross-site scripting vulnerability exists in versions of ClearML Server prior to 1.13.0 that stems from vulnerability to stored cross-site scripting XSS attacks...

CVE-2023-50870

In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible...

OESA-2023-1930 nodejs-tough-cookie security update

RFC6265 Cookies and Cookie Jar for Node.js. Security Fixes: Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects a...

LOCKSS Daemon Security Vulnerability

LOCKSS Daemon is a research-based open source software application from LOCKSS that provides powerful peer-to-peer digital preservation. A security vulnerability exists in LOCKSS Daemon versions prior to 1.77.3 that stems from allowing an attacker to bypass access restrictions...

AZL-67467 CVE-2023-50472 affecting package apparmor for versions less than 3.1.7-1

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSONSetValuestring at cJSON.c...

CVE-2023-48661

Dell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability to read arbitrary files from the target system...

Mlflow Path Traversal Vulnerability

Mlflow is an open source platform for machine learning lifecycles. A path traversal vulnerability exists in Mlflow versions prior to 2.9.2, which stems from the ability to write arbitrary files while loading a dataset...

Weseek GROWI Security Vulnerability

Weseek GROWI is a team collaboration software from Weseek Japan. A security vulnerability exists in Weseek GROWI versions prior to v3.4.0. An attacker could exploit this vulnerability to conduct cross-site scripting attacks...

PT-2023-31277 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Zoom versions prior to 5.16.5 Description: The issue is related to improper authentication in some Zoom clients, which may allow an authenticated user to conduct a denial of service via network access. Recommendations: For versions prior to...

Health Level 7 Security Vulnerability

Health Level 7 is a series of global standards for transferring clinical and administrative health data between applications from Health Level 7, Inc. A security vulnerability exists in Health Level 7 versions prior to 5.6.106 that stems from a package decompression feature in the core library th...

NCP Secure Enterprise Client Security Vulnerability

NCP Secure Enterprise Client is a VPN Virtual Private Network client application from NCP Germany. A security vulnerability exists in NCP Secure Enterprise Client versions prior to 12.22 that originates from a vulnerability that allows an attacker to delete arbitrary files on the operating system...

CVE-2023-46496

Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function in api/files endpoint...

AZL-32102 CVE-2023-39326 affecting package golang for versions less than 1.21.5-1

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data up to about...