An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Elastic Agent attempted to ingest, this...
AFFECTED_PRODUCTS:
Elastic Elastic Agent,
Elastic Elastic Agent
An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or Elastic Agent attemp...
AFFECTED_PRODUCTS:
Elastic Elastic Beats,
Elastic Elastic Beats
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (Editor, etc.) are able to access some unintended endpoints. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
AFFECTED_PRODUCTS:
Umbraco Umbraco Cms,
Umbraco Umbraco Cms,
Umbraco Umbraco Cms
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 con...
AFFECTED_PRODUCTS:
Umbraco Umbraco Cms,
Umbraco Umbraco Cms,
Umbraco Umbraco Cms
An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released 8...
AFFECTED_PRODUCTS:
Elastic Enterprise Search,
Elastic Enterprise Search
Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross-site scripting (XSS) vulnerability enabling attackers to bring malicious content into a website or application. Versions 10.8.1 and 12.3.4 contain a patch for...
AFFECTED_PRODUCTS:
Umbraco Umbraco Cms,
Umbraco Umbraco Cms
main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.
AFFECTED_PRODUCTS:
Arjunsharda Searchor
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows 11 21h2,
Microsoft Windows 10 1809,
Microsoft Windows 10 21h2
... (+4)
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows 11 23h2
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
AFFECTED_PRODUCTS:
Microsoft Dynamics 365,
Microsoft Dynamics 365
Microsoft Power Platform Connector Spoofing Vulnerability
AFFECTED_PRODUCTS:
Microsoft Azure Logic Apps,
Microsoft Power Platform
DHCP Server Service Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012
Win32k Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2012,
Microsoft Windows 10 1507,
Microsoft Windows 10 1607
... (+6)
Microsoft Defender Denial of Service Vulnerability
AFFECTED_PRODUCTS:
Microsoft Malware Protection Platform
Microsoft Word Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft Office,
Microsoft Office
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows 10 1507
... (+7)
Windows Telephony Server Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows 10 1507
... (+7)
Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows 10 1507
... (+7)
XAML Diagnostics Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows 10 1507,
Microsoft Windows 10 1607,
Microsoft Windows 11 21h2
... (+5)
Windows Sysmain Service Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows 11 21h2,
Microsoft Windows 10 1809,
Microsoft Windows 10 21h2
... (+3)
DHCP Server Service Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2012
Internet Connection Sharing (ICS) Denial of Service Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows 10 1507
... (+7)
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows 10 1507
... (+7)
Microsoft ODBC Driver Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows 10 1507
... (+7)
DHCP Server Service Denial of Service Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2012
Microsoft Outlook Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft Office,
Microsoft Office Long Term Servicing Channel
Windows Kernel Denial of Service Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows 11 22h2,
Microsoft Windows 11 23h2
Windows Bluetooth Driver Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows 11 21h2,
Microsoft Windows 11 22h2,
Microsoft Windows 11 23h2
Windows Kernel Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows 10 1507
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows 10 1507
... (+4)
Win32k Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows 11 21h2,
Microsoft Windows 11 22h2,
Microsoft Windows 11 23h2
... (+1)
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows 10 1507
... (+8)
Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows 10 1507
Windows MSHTML Platform Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows 10 1507
... (+8)
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Azure Machine Learning Software Development Kit
Azure Connected Machine Agent Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Azure Connected Machine Agent
Windows DNS Spoofing Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2022 23h2
Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
AFFECTED_PRODUCTS:
Microsoft Dynamics 365,
Microsoft Dynamics 365
Microsoft Outlook for Mac Spoofing Vulnerability
AFFECTED_PRODUCTS:
Microsoft Office Long Term Servicing Channel
Windows Media Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows 10 1507
... (+8)
A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to send packets with another VPN user's source IP address. This vulnerability is due to improper valid...
AFFECTED_PRODUCTS:
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software
... (+236)
The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected cipherte...
AFFECTED_PRODUCTS:
Mozilla Nss
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a pat...
AFFECTED_PRODUCTS:
Umbraco Umbraco Cms,
Umbraco Umbraco Cms,
Umbraco Umbraco Cms
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a...
AFFECTED_PRODUCTS:
Umbraco Umbraco Cms,
Umbraco Umbraco Cms,
Umbraco Umbraco Cms
The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely.
AFFECTED_PRODUCTS:
Opcfoundation Ua .netstandard
The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {content} use cases that may be edge cases.
AFFECTED_PRODUCTS:
Sitegeist Fluid Components
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. NOTE: this issue exists beca...
AFFECTED_PRODUCTS:
Hapifhir Hl7 Fhir Core
fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
AFFECTED_PRODUCTS:
Naturalintelligence Fast Xml Parser
The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form). This occurs because the usergroup.inList protection mechanism is mishandled.
AFFECTED_PRODUCTS:
In2Code Femanager,
In2Code Femanager,
In2Code Femanager
In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project.
AFFECTED_PRODUCTS:
Suse Rancher,
Suse Rancher