If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Firefox,
Debian Debian Linux
... (+1)
A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Firefox,
Debian Debian Linux
... (+1)
Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Firefox,
Debian Debian Linux
... (+1)
When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
AFFECTED_PRODUCTS:
Mozilla Firefox,
Mozilla Firefox,
Debian Debian Linux
... (+1)
IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337.
AFFECTED_PRODUCTS:
IBM Common Licensing
A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2.11 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
AFFECTED_PRODUCTS:
Fortinet FortiManager,
Fortinet FortiManager,
Fortinet FortiManager
... (+2)
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_rbtree: skip end interval element from gc
rbtree lazy gc on insert might collect an end interval element that has
been just added in this transactions, skip end interval elements that
are not yet active.
AFFECTED_PRODUCTS:
Debian Debian Linux,
Linux Linux Kernel,
Linux Linux Kernel
... (+4)
In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote a...
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Liferay Portal,
Liferay Digital Experience Platform
... (+3)
The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which a...
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Liferay Portal,
Liferay Digital Experience Platform
... (+3)
In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users...
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Digital Experience Platform,
Liferay Digital Experience Platform
... (+2)
A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The complexity of...
AFFECTED_PRODUCTS:
Totolink X6000r Firmware
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
New elements in this transaction might expired before such transaction
ends. Skip sync GC for such elements otherwise commit path might walk
over an alre...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Netapp Ontap Tools,
Netapp Ontap Tools
A use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafted DICOM file can cause premature freeing of memory that is used later. To trigger this vulnerability, an attacker would need to induce the vulnerable applicatio...
AFFECTED_PRODUCTS:
Nih Libdicom
A use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafted DICOM file can cause premature freeing of memory that is used later. To trigger this vulnerability, an attacker would need to induce the vulnerable applicatio...
AFFECTED_PRODUCTS:
Nih Libdicom
The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable
AFFECTED_PRODUCTS:
Openvpn Connect,
Openvpn Connect,
Openvpn Connect
... (+6)
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to red...
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Digital Experience Platform,
Liferay Digital Experience Platform
... (+2)
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote a...
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Digital Experience Platform,
Liferay Digital Experience Platform
... (+2)
The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers...
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Digital Experience Platform,
Liferay Digital Experience Platform
... (+2)
Arbitrary File Read Vulnerability in Apache Dolphinscheduler.
This issue affects Apache DolphinScheduler: before 3.2.1.
We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
AFFECTED_PRODUCTS:
Apache Dolphinscheduler
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.
Users are recommended to upgrade to version 3.2.1, which fixes this issue.
AFFECTED_PRODUCTS:
Apache Dolphinscheduler
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.
This issue affects Apache DolphinScheduler: before 3.2.0.
Users are recommended to upgrade to version 3.2.1, which f...
AFFECTED_PRODUCTS:
Apache Dolphinscheduler
Exposure of Remote Code Execution in Apache Dolphinscheduler.
This issue affects Apache DolphinScheduler: before 3.2.1.
We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
AFFECTED_PRODUCTS:
Apache Dolphinscheduler
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive info...
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Digital Experience Platform,
Liferay Digital Experience Platform
... (+2)
The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers...
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Digital Experience Platform,
Liferay Digital Experience Platform
... (+2)
Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit thei...
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Digital Experience Platform,
Liferay Digital Experience Platform
... (+2)
In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction.
The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability. It is possible to upload files within the Media Center of OpenOlat version 18.1.5 (or lower) as an authenticated user without any other rights. Although the filetypes are limited, an SVG image containing...
AFFECTED_PRODUCTS:
Frentix Openolat
The Frentix GmbH OpenOlat LMS is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities. An attacker with rights to create or edit groups can create a course with a name that contains an XSS payload. Furthermore, attackers with the permissions to create or rename a catalog (sub-categ...
AFFECTED_PRODUCTS:
Frentix Openolat
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's...
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Digital Experience Platform,
Liferay Digital Experience Platform
... (+1)
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled, whi...
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Digital Experience Platform,
Liferay Digital Experience Platform
... (+1)
In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication)Â method.
Specifically, an application is vulnerable if:
* The appl...
AFFECTED_PRODUCTS:
VMware Spring Security,
VMware Spring Security
Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter.
AFFECTED_PRODUCTS:
Liferay Digital Experience Platform,
Liferay Digital Experience Platform,
Liferay Digital Experience Platform
... (+4)
Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal...
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Digital Experience Platform,
Liferay Digital Experience Platform
... (+5)
Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page.
AFFECTED_PRODUCTS:
Liferay Liferay Portal,
Liferay Digital Experience Platform,
Liferay Digital Experience Platform
... (+2)
The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scri...
AFFECTED_PRODUCTS:
Ylefebvre Link Library
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip shortcode in all versions up to, and including, 7.0.2 due to insufficient input sanitization and output escaping on user supplied attributes and user supplied...
AFFECTED_PRODUCTS:
Getshortcodes Shortcodes Ultimate
A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W...
AFFECTED_PRODUCTS:
Zyxel Atp200 Firmware,
Zyxel Atp200 Firmware,
Zyxel Atp500 Firmware
... (+39)
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk e...
AFFECTED_PRODUCTS:
Node.js Node.js,
Node.js Node.js,
Node.js Node.js
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, nam...
AFFECTED_PRODUCTS:
Node.js Node.js,
Node.js Node.js
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE.
Due to a bug in the implementation of this exception, Node.js incorrectly applies this exc...
AFFECTED_PRODUCTS:
Node.js Node.js,
Node.js Node.js,
Node.js Node.js
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack.
This vulnerability affects all users using the experimental...
AFFECTED_PRODUCTS:
Node.js Node.js,
Node.js Node.js
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example:
```
--allow-fs-read=/home/node/.ssh/*.pub
```
will ignore `pub` and give access to everything after `.ssh/`.
This misleading documentation affec...
AFFECTED_PRODUCTS:
Node.js Node.js,
Node.js Node.js
Expression Language Injection vulnerability in Hitachi Global Link Manager on Windows allows Code Injection.This issue affects Hitachi Global Link Manager: before 8.8.7-03.
AFFECTED_PRODUCTS:
Hitachi Global Link Manager
A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 P...
AFFECTED_PRODUCTS:
Zyxel Atp200 Firmware,
Zyxel Atp200 Firmware,
Zyxel Atp500 Firmware
... (+40)
A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN...
AFFECTED_PRODUCTS:
Zyxel Atp200 Firmware,
Zyxel Atp200 Firmware,
Zyxel Atp500 Firmware
... (+60)
A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR com...
AFFECTED_PRODUCTS:
Zyxel Atp200 Firmware,
Zyxel Atp200 Firmware,
Zyxel Atp500 Firmware
... (+35)
electron-pdf version 20.0.0 allows an external attacker to remotely obtain
arbitrary local files. This is possible because the application does not
validate the HTML content entered by the user.
AFFECTED_PRODUCTS:
Fraserxu Electron Pdf
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain
arbitrary local files. This is possible because the application does not
validate the HTML content entered by the user.
AFFECTED_PRODUCTS:
Kumaf Pyhtml2pdf
Torrentpier version 2.4.1 allows executing arbitrary commands on the server.
This is possible because the application is vulnerable to insecure deserialization.
AFFECTED_PRODUCTS:
Torrentpier Torrentpier
Suite CRM version 7.14.2 allows including local php files. This is possible
because the application is vulnerable to LFI.
AFFECTED_PRODUCTS:
Salesagility Suitecrm