An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to the lack of any authentication method, resulting in the alteration or creation of users.
AFFECTED_PRODUCTS:
Europeana Repox
When a program running on an affected system appends data to a file via an NFS client mount, the bug can cause the NFS client to fail to copy in the data to be written but proceed as though the copy operation had succeeded. This means that the data to be written is instead replaced with whatever da...
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd
In versions of FreeBSD 14.0-RELEASE before 14-RELEASE-p2, FreeBSD 13.2-RELEASE before 13.2-RELEASE-p7 and FreeBSD 12.4-RELEASE before 12.4-RELEASE-p9, the pf(4) packet filter incorrectly validates TCP sequence numbers. Â This could allow a malicious actor to execute a denial-of-service attack against...
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd,
FreeBSD Freebsd
** UNSUPPORTED WHEN ASSIGNED **An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5.1.2 may allow an authenticated attacker to escalate his privileges via HTTP or HTTPs requests with crafted JWT token values.
AFFECTED_PRODUCTS:
Fortinet Fortiwan,
Fortinet Fortiwan,
Fortinet Fortiwan
... (+1)
** UNSUPPORTED WHEN ASSIGNED **A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1. through 5.1.2 may allow an authenticated attacker to read and delete arbitrary file of the system...
AFFECTED_PRODUCTS:
Fortinet Fortiwan,
Fortinet Fortiwan,
Fortinet Fortiwan
... (+1)
Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of malicious libraries
AFFECTED_PRODUCTS:
Checkmk Checkmk
The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer.
AFFECTED_PRODUCTS:
VMware Photon Os,
VMware Photon Os
An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below may allow a remote unauthenticated attacker to bypass the firewall deny geolocalis...
AFFECTED_PRODUCTS:
Fortinet FortiOS,
Fortinet FortiOS,
Fortinet FortiOS
... (+3)
Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.
These design document functions are:
* Â list
* Â show
* Â rewrite
* Â update
An attacker can leak the session component using an...
AFFECTED_PRODUCTS:
Apache CouchDB
A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.
AFFECTED_PRODUCTS:
Debian Debian Linux,
Debian Debian Linux,
Debian Debian Linux
... (+3)
A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.
AFFECTED_PRODUCTS:
Debian Debian Linux,
Debian Debian Linux,
Debian Debian Linux
... (+3)
An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, version 7.0.6 and below may allow a remote authenticated attacker with at least R/W permission to execute unauthorized commands via specifically crafted argumen...
AFFECTED_PRODUCTS:
Fortinet Fortiportal,
Fortinet Fortiportal
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters
AFFECTED_PRODUCTS:
Fortinet Fortiwlm
An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs via a crafted URL of the web application.
AFFECTED_PRODUCTS:
Fortinet FortiWeb,
Fortinet FortiWeb,
Fortinet FortiWeb
... (+2)
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Account...
AFFECTED_PRODUCTS:
Elastic Kibana,
Elastic Kibana
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibana_system user, API Keys, and cred...
AFFECTED_PRODUCTS:
Elastic Kibana
An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox version 4.4.1 and 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 allows attacker to execute unauthorized code or commands via crafte...
AFFECTED_PRODUCTS:
Fortinet Fortisandbox,
Fortinet Fortisandbox,
Fortinet Fortisandbox
... (+4)
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox version 4.4.1 and 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.4 allows attacker to execute unauthorized code...
AFFECTED_PRODUCTS:
Fortinet Fortisandbox,
Fortinet Fortisandbox,
Fortinet Fortisandbox
... (+5)
A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request.
AFFECTED_PRODUCTS:
Fortinet FortiOS,
Fortinet FortiOS,
Fortinet FortiOS
... (+9)
An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests.
AFFECTED_PRODUCTS:
Fortinet Fortiadc,
Fortinet Fortiadc,
Fortinet Fortiadc
... (+6)
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] Â in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup...
AFFECTED_PRODUCTS:
Fortinet Fortitester,
Fortinet Fortitester,
Fortinet Fortitester
... (+32)
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows at...
AFFECTED_PRODUCTS:
Fortinet FortiOS,
Fortinet FortiOS,
Fortinet FortiOS
... (+7)
A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6....
AFFECTED_PRODUCTS:
Fortinet Fortimail,
Fortinet Fortimail,
Fortinet Fortimail
... (+15)
Improper Authentication vulnerability in Nadatel DVR allows Information Elicitation.This issue affects DVR: from 3.0.0 before 9.9.0.
AFFECTED_PRODUCTS:
Nadatel At 0402r Firmware,
Nadatel At 0815r Firmware,
Nadatel At 1623r Firmware
... (+15)
Relyum RELY-PCIe 22.2.1 devices suffer from a system group misconfiguration, allowing read access to the central password hash file of the operating system.
AFFECTED_PRODUCTS:
Relyum Rely Pcie Firmware
Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices are susceptible to Cross Site Request Forgery (CSRF) attacks due to the absence of CSRF protection in the web interface.
AFFECTED_PRODUCTS:
Relyum Rely Pcie Firmware,
Relyum Rely Rec Firmware
An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current password.
AFFECTED_PRODUCTS:
Relyum Rely Pcie Firmware,
Relyum Rely Rec Firmware
An issue was discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices, allowing authenticated command injection through the web interface.
AFFECTED_PRODUCTS:
Relyum Rely Pcie Firmware,
Relyum Rely Rec Firmware
An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. The web interfaces of the Relyum devices are susceptible to reflected XSS.
AFFECTED_PRODUCTS:
Relyum Rely Pcie Firmware,
Relyum Rely Rec Firmware
An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. There is a Weak SMB configuration with signing disabled.
AFFECTED_PRODUCTS:
Relyum Rely Pcie Firmware,
Relyum Rely Rec Firmware
An issue discovered in Relyum RELY-PCIe 22.2.1 devices. The authorization mechanism is not enforced in the web interface, allowing a low-privileged user to execute administrative functions.
AFFECTED_PRODUCTS:
Relyum Rely Pcie Firmware,
Relyum Rely Rec Firmware
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hanbiro Hanbiro groupware allows Information Elicitation.This issue affects Hanbiro groupware: from V3.8.79 before V3.8.81.1.
AFFECTED_PRODUCTS:
Hanbiro Groupware
A race condition issue discovered in Samsung Mobile Processor Exynos 9820, 980, 1080, 2100, 2200, 1280, and 1380 allows unintended modifications of values within certain areas.
Samsung Mobile Processor and Wearable Processor (Exynos 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, and W920) allow Information Disclosure in the Bootloader.
A TOCTOU race condition in Samsung Mobile Processor Exynos 9820, Exynos 980, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, and Exynos 1380 can cause unexpected termination of a system.
Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.
AFFECTED_PRODUCTS:
Lfprojects Mlflow
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs `/files/get/?name=...` and `/files/download/?name=...` are used to provi...
AFFECTED_PRODUCTS:
Networktocode Nautobot,
Networktocode Nautobot
Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including
8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.
AFFECTED_PRODUCTS:
Hitachi Pentaho Data Integration And Analytics,
Hitachi Pentaho Data Integration And Analytics
A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host a...
AFFECTED_PRODUCTS:
Red Hat Enterprise Linux
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.
AFFECTED_PRODUCTS:
Fedoraproject Fedora,
Fedoraproject Fedora,
Red Hat Ansible
... (+6)
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster...
AFFECTED_PRODUCTS:
Red Hat Jboss Enterprise Application Platform,
Red Hat Single Sign On
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when the `href` attribute from the `<use>` tag has not been s...
AFFECTED_PRODUCTS:
Dompdf Php Svg Lib
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the m...
AFFECTED_PRODUCTS:
Dompdf Php Svg Lib
Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another obj,...
AFFECTED_PRODUCTS:
Laf Laf,
Laf Laf,
Laf Laf
... (+80)
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack (quicly), as used by H2O up to commit 43f86e5 (in version 2.3.0-beta and prior), is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressive...
AFFECTED_PRODUCTS:
Dena H2o,
Dena H2o
Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a brows...
AFFECTED_PRODUCTS:
Umbraco Umbraco Cms,
Umbraco Umbraco Cms,
Umbraco Umbraco Cms
... (+2)
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can be used to collect valid usernames. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
AFFECTED_PRODUCTS:
Umbraco Umbraco Cms,
Umbraco Umbraco Cms,
Umbraco Umbraco Cms
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this is...
AFFECTED_PRODUCTS:
Umbraco Umbraco Cms,
Umbraco Umbraco Cms,
Umbraco Umbraco Cms
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious backend entity that also has the opportuni...
AFFECTED_PRODUCTS:
Dena H2o,
Dena H2o
Workspace ONE Launcher contains a Privilege Escalation Vulnerability. A malicious actor with physical access to Workspace ONE Launcher could utilize the Edge Panel feature to bypass setup to gain access to sensitive information.
AFFECTED_PRODUCTS:
VMware Workspace One Launcher