8513 matches found
AZL-31324 CVE-2023-44487 affecting package local-path-provisioner for versions less than 0.0.21-12
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-35114 CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
Microsoft Response to Distributed Denial of Service (DDoS) Attacks against HTTP/2
Summary Beginning in September 2023, Microsoft was notified by industry partners about a newly identified Distributed Denial-of-Service DDoS attack technique being used in the wild targeting HTTP/2 protocol. This vulnerability CVE-2023-44487 impacts any internet exposed HTTP/2 endpoints. As an...
PT-2023-13009 · Sinec Nms · Sinec Nms
Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V2.0 Description: A vulnerability has been identified in the affected application, where it assigns improper access rights to specific folders containing executable files and libraries. This could allow an...
ChiefOnboarding Cross-Site Request Forgery Vulnerability
ChiefOnboarding is a free and open source employee onboarding platform. A cross-site request forgery vulnerability exists in versions prior to ChiefOnboarding v2.0.47, which stems from a cross-site request forgery CSRF vulnerability in...
PT-2023-5873 · Libcue +6 · Libcue +6
Name of the Vulnerable Software and Affected Versions: libcue versions 2.2.1 and prior Description: The issue is related to out-of-bounds array access in libcue, which provides an API for parsing and extracting data from CUE sheets. A user of the GNOME desktop environment can be exploited by...
Delta Electronics WPLSoft Security Vulnerability
Delta Electronics WPLSoft is a software tool for programming Delta Programmable Logic Controllers PLCs from Delta Electronics, Inc. of Taiwan, China. A security vulnerability exists in Delta Electronics WPLSoft version 2.51, which originates from the transmission of sensitive information in clear...
DEBIAN-CVE-2023-43615
Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow...
CVE-2023-28791
Cross-Site Request Forgery CSRF vulnerability in Gangesh Matta Simple Org Chart plugin = 2.3.4 versions...
CVE-2023-27448
Cross-Site Request Forgery CSRF vulnerability in MakeStories Team MakeStories for Google Web Stories plugin = 2.8.0 versions...
The vulnerability in the function for protecting group IP traffic in the GET VPN implementation, based on the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols, allows a attacker to execute arbitrary code, cause service failures, or gain full control over the application.
The vulnerability in the function for protecting group IP traffic in the GET VPN implementation of the Group Domain of Interpretation GDOI and G-IKEv2 protocols on Cisco IOS and IOS XE operating systems stems from the operation of operations beyond the buffer in memory when processing protocol...
PJSIP Resource Management Error Vulnerability
PJSIP is a free and open source multimedia communications library written in C that implements standards-based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. A resource management error vulnerability exists in versions of PJSIP prior to 2.14, which stems from a higher-level transfer being...
CVE-2023-3701
Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged user could access/modify stored resources of other users. It could also be possible to access and modify the source and configuration files o...
CVE-2023-5357 Instagram for WordPress <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Instagram for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...
CVE-2023-44974
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file...
CVE-2023-37891
Cross-Site Request Forgery CSRF vulnerability in OptiMonk OptiMonk: Popups, Personalization & A/B Testing plugin = 2.0.4 versions...
An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32.
...
CVE-2023-44009
File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management function...
ZZZCMS Authorization Issues Vulnerabilities
ZZZCMS zzzphp is a content management system CMS. An authorization issue vulnerability exists in ZZZCMS version 2.1.7, which stems from improper privilege management...