Lucene search

K

Tips And Tricks HQ, Josh401 Security Vulnerabilities

osv
osv

Cockpit CMS contains an arbitrary file upload vulenrability

A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. An attacker could upload files to the server, compromising the entire...

9.8CVSS

9.5AI Score

0.0004EPSS

2024-05-14 06:30 PM
9
veracode
veracode

Unrestricted File Upload

cockpit-hq/cockpit is vulnerable to Unrestricted File Upload. The vulnerability is due to an improper file upload checks within the /media/api POST endpoint which can be exploited to compromise the system's integrity, allowing unauthorized access or data...

9.8CVSS

6.8AI Score

0.0004EPSS

2024-05-16 06:19 AM
4
github
github

Cockpit CMS contains an arbitrary file upload vulenrability

A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. An attacker could upload files to the server, compromising the entire...

9.8CVSS

6.9AI Score

0.0004EPSS

2024-05-14 06:30 PM
7
ibm
ibm

Security Bulletin: IBM® Db2® is vulnerable to a denial of service with a specially crafted query under certain conditions. (CVE-2024-28762)

Summary IBM® Db2® is vulnerable to a denial of service with a specially crafted query under certain conditions. Vulnerability Details ** CVEID: CVE-2024-28762 DESCRIPTION: **IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) is vulnerable to denial of service with a specially...

5.3CVSS

6.5AI Score

0.0004EPSS

2024-06-11 05:30 PM
2
ibm
ibm

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when using a specially crafted statement. (CVE-2024-31880)

Summary IBM® Db2® is vulnerable to a denial of service, under specific configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user. Vulnerability Details ** CVEID: CVE-2024-31880 DESCRIPTION: **IBM Db2 for Linux, UNIX and Windows (includes Db2...

7AI Score

EPSS

2024-06-11 05:40 PM
3
ibm
ibm

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when using a specially crafted query on certain columnar tables. (CVE-2024-31881)

Summary IBM® Db2® is vulnerable to a denial of service as the server may crash when using a specially crafted query on certain columnar tables by an authenticated user. Vulnerability Details ** CVEID: CVE-2024-31881 DESCRIPTION: **IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server)...

6.5CVSS

6.5AI Score

0.0004EPSS

2024-06-11 05:41 PM
2
ibm
ibm

Security Bulletin: IBM® Db2® is affected by a vulnerability in the open source zlib library. (CVE-2023-45853)

Summary IBM® Db2® is affected by a vulnerability in the open source zlib library. Vulnerability Details ** CVEID: CVE-2023-45853 DESCRIPTION: **MiniZip is vulnerable to a denial of service, caused by an integer overflow and resultant heap-based buffer overflow in the zipOpenNewFileInZip4_64...

9.8CVSS

7.2AI Score

0.001EPSS

2024-06-11 05:24 PM
3
ibm
ibm

Security Bulletin: Vulnerability in Java affects Tivoli System Automation for Multiplatforms shipped with IBM® Db2® LUW. (CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926, CVE-2024-20945, CVE-2023-33850)

Summary Security vulnerabilities have been identified in Java that affect Tivoli System Automation for Multiplatforms (TSAMP) shipped as a component of IBM Db2. Vulnerability Details Refer to the security bulletin(s) listed in the Remediation/Fixes section Affected Products and Versions TSAMP...

7.5CVSS

6.8AI Score

0.001EPSS

2024-06-05 03:47 PM
2
ibm
ibm

Security Bulletin: IBM® Db2® federated server is affected by vulnerabilities in the open source commons-configuration2 library. (CVE-2024-29131, CVE-2024-29133)

Summary IBM® Db2® federated server is affected by vulnerabilities in the open source commons-configuration2 library when using the NoSQL Hadoop wrapper. Vulnerability Details ** CVEID: CVE-2024-29131 DESCRIPTION: **Apache Commons Configuration could allow a remote attacker to execute arbitrary...

7.7AI Score

0.0004EPSS

2024-06-11 05:39 PM
2
ibm
ibm

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables. (CVE-2023-29267)

Summary IBM® Db2® is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables. Vulnerability Details ** CVEID: CVE-2023-29267 DESCRIPTION: **IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as a trap...

5.3CVSS

6.7AI Score

0.0004EPSS

2024-06-11 07:48 PM
1
ibm
ibm

Security Bulletin: IBM® Db2® NSE (Net Search Extender) is affected by a vulnerability in the open source Expat library. (CVE-2024-28757)

Summary IBM® Db2® NSE (Net Search Extender) is affected by a vulnerability in the open source Expat library. Vulnerability Details ** CVEID: CVE-2024-28757 DESCRIPTION: **libexpat could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity...

6.1AI Score

0.0004EPSS

2024-06-11 05:31 PM
1
veracode
veracode

DNS Poisoning

Bouncy Castle Java Cryptography APIs are vulnerable to improper SSL/TLS hostname verification. The vulnerability is due to hostname verification potentially being performed against a DNS-resolved IP address when no explicit hostname is provided, which could lead to DNS poisoning...

6.7AI Score

0.0004EPSS

2024-05-06 06:27 AM
11
ibm
ibm

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in the open source netty-codec-http library. (CVE-2024-29025)

Summary IBM® Db2® federated server is affected by a vulnerability in the open source netty-codec-http library when using the NoSQL Blockchain wrapper. Vulnerability Details ** CVEID: CVE-2024-29025 DESCRIPTION: **Netty is vulnerable to a denial of service, caused by a flaw when using the...

5.3CVSS

6.6AI Score

0.0004EPSS

2024-06-11 05:35 PM
4
ibm
ibm

Security Bulletin: IBM® Db2® is vulnerable to a denial of service when a specially crafted request is used via CLI. (CVE-2023-45178)

Summary IBM® Db2® is vulnerable to a denial of service when a specially crafted request is used via CLI. Vulnerability Details ** CVEID: CVE-2023-45178 DESCRIPTION: **IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) CLI is vulnerable to a denial of service when a specially...

7.5CVSS

6.9AI Score

0.001EPSS

2024-06-11 05:29 PM
16
ibm
ibm

Security Bulletin: IBM® Db2® federated server is affected by vulnerabilities in the open source commons-compress library. (CVE-2024-25710, CVE-2024-26308)

Summary IBM® Db2® federated server is affected by vulnerabilities in the open source commons-compress library when using the NoSQL Blockchain wrapper. Vulnerability Details ** CVEID: CVE-2024-25710 DESCRIPTION: **Apache Commons Compress is vulnerable to a denial of service, caused by an infinite...

8.1CVSS

7AI Score

0.001EPSS

2024-06-11 05:27 PM
4
cisco
cisco

Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Secure Email Gateway, formerly Email Security Appliance (ESA); and Secure Web Appliance could allow a remote attacker to conduct a cross-site scripting (XSS) attack...

5.9AI Score

0.0004EPSS

2024-05-15 04:00 PM
4
veeam
veeam

VM Disks Support for oVirt Incremental Backup

Backup warning: "Unable to enabled ovirt incremental backups for disk. Full scan backups will be...

7.1AI Score

2021-10-07 12:00 AM
7
osv
osv

CVE-2022-46147

Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0...

8.4CVSS

6AI Score

0.001EPSS

2022-11-28 09:15 PM
4
ibm
ibm

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Service Registry and Repository due to April 2024 CPU

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, used by WebSphere Service Registry and Repository. These issues were disclosed as part of the IBM Java SDK updates in April 2024. These issues are addressed by WebSphere Application Server shipped with WebSphere Service....

6.9AI Score

2024-05-21 12:47 PM
7
veracode
veracode

Observable Discrepancy

Bouncy Castle is vulnerable to Observable Discrepancy. The vulnerability is due to improper handling of exceptions in RSA-based handshakes. An attacker can exploit the timing differences observed during these exceptions to reveal sensitive...

6AI Score

0.0004EPSS

2024-04-25 03:52 PM
8
veracode
veracode

Arbitrary Code Execution

Jetty-servlets is vulnerable to Arbitrary Code Execution. The vulnerability is due to insecure escaping of user input which can result in the execution of arbitrary commands. This vulnerability occurs in the CGI servlet handler through the getRuntime.exec()...

4.3CVSS

7.3AI Score

0.001EPSS

2023-09-20 10:17 AM
20
ibm
ibm

Security Bulletin: Multiple vulnerabilities affect IBM Db2® REST

Summary IBM has released the below fix for IBM Db2® REST in response to multiple vulnerabilities found in multiple components. The vulnerabilities have been addressed. Vulnerability Details ** CVEID: CVE-2021-35942 DESCRIPTION: **GNU C Library (aka glibc) could allow a local attacker to obtain...

9.8CVSS

9.5AI Score

0.962EPSS

2024-05-20 11:34 PM
16
ibm
ibm

Security Bulletin: Multiple vulnerabilities affect IBM Db2® REST

Summary IBM has released the below fix for IBM Db2® REST in response to multiple vulnerabilities found in multiple components. The vulnerabilities have been addressed. Vulnerability Details ** CVEID: CVE-2023-45283 DESCRIPTION: **Golang Go could allow a remote attacker to traverse directories on...

7.5CVSS

7.5AI Score

0.001EPSS

2024-05-20 04:22 PM
13
veeam
veeam

How to use Veeam Backup for Nutanix AHV/Veeam Backup for Red Hat Virtualization Proxy with Internal CA Certificates

By default, these components are only aware of publicly available Certification Authorities. If an Internal CA is used to sign the Cluster or Veeam Backup & Replication certificate, these components will fail to verify the certificate, and communication will...

7.1AI Score

2023-03-27 12:00 AM
9
rocky
rocky

virt:rhel and virt-devel:rhel security and enhancement update

An update is available for module.swtpm, module.libtpms, module.libnbd, netcf, module.nbdkit, hivex, libiscsi, libtpms, module.sgabios, libguestfs-winsupport, virt-v2v, module.supermin, module.virt-v2v, module.libvirt-dbus, module.qemu-kvm, supermin, swtpm, libvirt-dbus, sgabios, qemu-kvm,...

7CVSS

7.4AI Score

0.002EPSS

2024-06-14 01:59 PM
nuclei
nuclei

Cockpit - Cross-Site Scripting

Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to...

6.1CVSS

6AI Score

0.002EPSS

2023-10-11 03:11 PM
5
osv
osv

Moderate: virt:rhel and virt-devel:rhel security and enhancement update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the....

7CVSS

7.3AI Score

0.002EPSS

2024-06-14 01:59 PM
2
trendmicroblog
trendmicroblog

Decoding Water Sigbin's Latest Obfuscation Tricks

Water Sigbin (aka the 8220 Gang) exploited the Oracle WebLogic vulnerabilities CVE-2017-3506 and CVE-2023-21839 to deploy a cryptocurrency miner using a PowerShell script. The threat actor also adopted new techniques to conceal its activities, making attacks harder to defend...

7.5CVSS

7.2AI Score

0.955EPSS

2024-05-30 12:00 AM
5
paloalto
paloalto

Impact of TunnelVision Vulnerability

The Palo Alto Networks Product Security Assurance team has evaluated the TunnelVision vulnerability as it relates to our products. This issue allows an attacker with the ability to send DHCP messages on the same local area network, such as a rogue Wi-Fi network, to leak traffic outside of the...

7.6CVSS

6.3AI Score

0.0005EPSS

2024-05-16 04:00 PM
16
cisco
cisco

Multiple Cisco Unified Communications Products Unauthenticated API High CPU Utilization Denial of Service Vulnerability

A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilization, which could impact access to the web-based management interface and cause delays with call processing. This API is not used for device....

7AI Score

0.001EPSS

2023-10-04 04:00 PM
23
rocky
rocky

evolution and evolution-data-server bug fix and enhancement update

An update is available for evolution, evolution-data-server. This update affects Rocky Linux 8. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this...

6.8AI Score

2024-06-14 01:59 PM
osv
osv

CVE-2024-22411

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious....

6.5CVSS

5.2AI Score

0.001EPSS

2024-01-16 10:15 PM
1
cve
cve

CVE-2024-33591

Missing Authorization vulnerability in Tips and Tricks HQ Easy Accept Payments.This issue affects Easy Accept Payments: from n/a through...

7.5CVSS

6.8AI Score

0.0004EPSS

2024-04-29 10:15 AM
24
packetstorm

7.4AI Score

EPSS

2024-06-13 12:00 AM
26
packetstorm

7.4AI Score

EPSS

2024-06-13 12:00 AM
29
ibm
ibm

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details ** CVEID:...

10CVSS

9.3AI Score

EPSS

2024-05-28 08:05 PM
7
metasploit
metasploit

Telerik Report Server Auth Bypass and Deserialization RCE

This module chains an authentication bypass vulnerability (CVE-2024-4358) with a deserialization vulnerability (CVE-2024-1800) to obtain remote code execution against Telerik Report Server version 10.0.24.130 and prior. The authentication bypass flaw allows an unauthenticated user to create a new.....

9.9CVSS

10AI Score

0.938EPSS

2024-06-12 12:58 PM
8
rocky
rocky

idm:DL1 and idm:client security update

An update is available for custodia, module.custodia, pyusb, python-qrcode, module.slapi-nis, module.pyusb, module.softhsm, python-jwcrypto, python-kdcproxy, module.opendnssec, module.python-kdcproxy, module.ipa, ipa-healthcheck, softhsm, module.python-jwcrypto, ipa, opendnssec, python-yubico,...

6.8CVSS

6.8AI Score

0.0004EPSS

2024-06-14 01:59 PM
rocky
rocky

bind and dhcp security update

An update is available for dhcp, bind. This update affects Rocky Linux 8. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Berkeley Internet Name Domain (BIND) is an implementation of the...

7.5CVSS

7.8AI Score

0.05EPSS

2024-06-14 01:59 PM
1
githubexploit
githubexploit

Exploit for Untrusted Pointer Dereference in Microsoft

PoC for CVE-2023-29360 Exploit targeting...

8.4CVSS

9.3AI Score

0.003EPSS

2023-09-24 09:59 PM
597
oraclelinux
oraclelinux

virt:ol and virt-devel:rhel security and enhancement update

hivex libguestfs [1.44.0-9.0.2] - libguestfs.spec: Add btrfs-progs RPM to appliance [Orabug: 35634755] [1.44.0-9.0.1] - Replace upstream references from description tag - Config supermin to use host yum.conf in ol8 [Orabug: 29319324] - Set DISTRO_ORACLE_LINUX correspeonding to ol [1:1.44.0-9] -...

7CVSS

8.3AI Score

0.002EPSS

2024-05-24 12:00 AM
8
cve
cve

CVE-2023-48285

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Tips and Tricks HQ Stripe Payments allows Code Injection.This issue affects Stripe Payments: from n/a through...

5.3CVSS

7.1AI Score

0.0004EPSS

2024-06-04 11:15 AM
1
cve
cve

CVE-2024-30527

Improper Validation of Specified Quantity in Input vulnerability in Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments) allows Manipulating Hidden Fields.This issue affects WP Express Checkout (Accept PayPal Payments): from n/a through...

7.5CVSS

6.8AI Score

0.0004EPSS

2024-05-17 09:15 AM
37
veracode
veracode

SQL Injection And Path Traversal

Cacti is vulnerable to SQL Injection and Path Traversal. The vulnerability is caused due to improper input sanitization within link.php component. This allows an authorized user to execute arbitrary code on the...

8.8CVSS

8.6AI Score

0.001EPSS

2023-12-28 08:43 AM
12
veracode
veracode

Arbitrary File Read And Write

qdrant-client is vulnerable to Arbitrary file read and write. The vulnerability is due to the snapshot recovery process allowing manipulation of snapshot files to include symlinks and also allows for the reading and writing of arbitrary files on the...

9.8CVSS

6.8AI Score

0.0004EPSS

2024-06-06 09:50 AM
packetstorm

7.4AI Score

EPSS

2024-06-13 12:00 AM
32
packetstorm

7.4AI Score

EPSS

2024-06-13 12:00 AM
32
rocky
rocky

dpdk bug fix and enhancement update

An update is available for dpdk. This update affects Rocky Linux 8. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 8.10...

6.8AI Score

2024-06-14 01:59 PM
rocky
rocky

dovecot bug fix and enhancement update

An update is available for dovecot. This update affects Rocky Linux 8. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux...

6.8AI Score

2024-06-14 01:59 PM
1
rocky
rocky

numatop bug fix and enhancement update

An update is available for numatop. This update affects Rocky Linux 8. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux...

6.8AI Score

2024-06-14 01:59 PM
Total number of security vulnerabilities2645409