CVE-2023-31427

Knowledge of full path name

Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned privilege. Starting with Fabric OS v9.1.0, “root” account access is disabled.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Fabric Operating System

CVE-2023-31425

Privilege escalation via the fosexec command

A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticated user to perform privilege escalation to root by breaking the rbash shell. Starting with Fabric OS v9.1.0, “root” account access is disabled.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Fabric Operating System

CVE-2023-31424

Web authentication and authorization bypass

Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Sannav

CVE-2023-31423

Possible information exposure through log file vulnerability

Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav before v2.3.0 and 2.2.2a. Notes: To access the logs, the local attacker must have access to an already collected Brocade SANnav "supportsave" outputs.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Sannav

CVE-2023-31419

Elasticsearch StackOverflow vulnerability

A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.

CVSS 3.1 · 6.5 Medium EPSS 61.1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2023-31417

Elasticsearch Insertion of sensitive information in audit logs

Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elasticsearch

CVE-2023-31130

Buffer Underwrite in ares_inet_net_pton()

c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

C-ares Project Debian Fedoraproject and 1 more

Products

C-ares Debian Linux Fedora and 3 more

CVE-2023-31125

Uncaught exception in engine.io

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package. Older versions are not impacted. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package, including those who use depending packages like `socket.io`. This issue was fixed in version 6.4.2 of Engine.IO. There is no known workaround except upgrading to a safe version.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Socket

Products

Engine.io

CVE-2023-31124

AutoTools does not set CARES_RANDOM_FILE during cross compilation

c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

C-ares Project Fedoraproject Redhat

Products

C-ares Fedora Enterprise Linux and 2 more

CVE-2023-30771

Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database. This problem is fixed from version 0.13.4 of iotdb-web-workbench onwards.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Apache

Products

Iotdb Iotdb Web Workbench

CVE-2023-30631

Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.  The configuration option proxy.config.http.push_method_enabled didn't function.  However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed

Vendors

Apache Debian Fedoraproject

Products

Traffic Server Debian Linux Fedora

CVE-2023-30465

Apache InLong: SQL injection in apache inLong 1.5.0

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.5.0. By manipulating the "orderType" parameter and the ordering of the returned content using an SQL injection attack, an attacker can extract the username of the   user with ID 1 from the "user" table, one character at a time.  Users are advised to upgrade to Apache InLong's 1.6.0 or cherry-pick [1] to solve it. https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html [1] https://github.com/apache/inlong/issues/7529 https://github.com/apache/inlong/issues/7529

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Apache

Products

Inlong

CVE-2023-30449

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 253439.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 4 more

CVE-2023-30448

IBM Db2 denial of service

IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253437.

CVSS 3.1 · 5.9 Medium EPSS 1.4% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 3 more

CVE-2023-30445

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253357.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 4 more

CVE-2023-2878

Kubernetes secrets-store-csi-driver discloses service account tokens in logs

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes

Products

Secrets-store-csi-driver

CVE-2023-2801

grafana: data source proxy race condition

Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Grafana Redhat

Products

Grafana Ceph Storage

CVE-2023-2728

Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Openshift Ironic

CVE-2023-2727

Bypassing policies imposed by the ImagePolicyWebhook admission plugin

Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Openshift Ironic

CVE-2023-2574

Authenticated Command Injection

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be triggered by authenticated users via a crafted POST request.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed

Vendors

Advantech

Products

Eki-1521 Eki-1521 Firmware Eki-1522 and 3 more