CVE-2023-34330

Code injection via Dynamic Redfish Extension interface

AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ami

Products

Megarac Sp-x

CVE-2023-34329

Authentication Bypass via HTTP Header Spoofing

AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.

CVSS 3.1 · 8.4 High EPSS 1.2% KEV · Not listed

Vendors

Ami

Products

Megarac Sp-x

CVE-2023-34212

Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed

Vendors

Apache

Products

Nifi

CVE-2023-34189

Apache InLong: General user can delete and update process

Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could use general users to delete and update the process, which only the admin can operate occurrences.  Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8109  to solve it.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Apache

Products

Inlong

CVE-2023-34149

Apache Struts: DoS via OOM owing to not properly checking of list bounds

Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.

CVSS 3.1 · 4.3 Medium EPSS 5.4% KEV · Not listed

Vendors

Apache

Products

Struts

CVE-2023-34055

Spring Boot server Web Observations DoS Vulnerability

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * org.springframework.boot:spring-boot-actuator is on the classpath

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Redhat Vmware

Products

Jboss Fuse Spring Boot

CVE-2023-34053

Spring Framework server Web Observations DoS Vulnerability

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * io.micrometer:micrometer-core is on the classpath * an ObservationRegistry is configured in the application to record observations Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Vmware

Products

Spring Framework

CVE-2023-33934

Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.

CVSS 3.1 · 9.1 Critical EPSS 1.6% KEV · Not listed

Vendors

Apache

Products

Traffic Server

CVE-2023-33933

Apache Traffic Server: s3_auth plugin problem with hash calculation

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Apache

Products

Traffic Server

CVE-2023-32732

Denial-of-Service in gRPC

gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in  https://github.com/grpc/grpc/pull/32309 https://www.google.com/url

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Grpc

Products

Fedora Grpc

CVE-2023-32681

Unintended leak of Proxy-Authorization header in requests

Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.

CVSS 3.1 · 6.1 Medium EPSS 3.0% KEV · Not listed

Vendors

Fedoraproject Python Redhat

Products

Fedora Requests Ansible Automation Platform and 5 more

CVE-2023-32323

Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse 1.74 or newer urgently.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Matrix

Products

Synapse

CVE-2023-32007

Apache Spark: Shell command injection via Spark UI

** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This issue was disclosed earlier as CVE-2022-33891, but incorrectly claimed version 3.1.3 (which has since gone EOL) would not be affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Users are recommended to upgrade to a supported version of Apache Spark, such as version 3.4.0.

CVSS 3.1 · 8.8 High EPSS 75.8% KEV · Not listed

Vendors

Apache

Products

Spark

CVE-2023-31928

XSS vulnerability in Brocade Webtools

A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html of Brocade Fabric OS version before Brocade Fabric OS v9.2.0 that could allow a remote unauthenticated attacker to execute arbitrary JavaScript code in a target user’s session with the Brocade Webtools application.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Fabric Operating System

CVE-2023-31927

An information disclosure in the web interface of Brocade Fabric OS

An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated attacker to get technical details about the web interface.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Fabric Operating System

CVE-2023-31926

Arbitrary File Overwrite using less command

System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Fabric Operating System

CVE-2023-31432

Privilege issues in multiple commands

Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain root privileges in Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c and v9.2.0.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Fabric Operating System

CVE-2023-31431

A buffer overflow vulnerability in “diagstatus” command

A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to crash the Brocade Fabric OS switch leading to a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Fabric Operating System

CVE-2023-31430

buffer overflow vulnerability in “secpolicydelete” command

A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated privileged user to crash the Brocade Fabric OS switch leading to a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Fabric Operating System

CVE-2023-31428

CLI allows upload or transfer files of dangerous types

Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user's home directory using grep.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Fabric Operating System