Search vulnerabilities

Expected end of text, found ',' (at char 30), (line:1, col:31)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,468

CVE-2024-23475

SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability

The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.

CVSS 3.1 · 9.6 Critical EPSS 2.1% KEV · Not listed
Vendors
Solarwinds
Products
Access Rights Manager
CVE-2024-23474

SolarWinds Access Rights Manager (ARM) deleteTransferFile Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability

The SolarWinds Access Rights Manager was found to be susceptible to an Arbitrary File Deletion and Information Disclosure vulnerability.

CVSS 3.1 · 7.6 High EPSS 1.5% KEV · Not listed
Vendors
Solarwinds
Products
Access Rights Manager
CVE-2024-23470

SolarWinds Access Rights Manager (ARM) UserScriptHumster Exposed Dangerous Method Remote Command Execution Vulnerability

The SolarWinds Access Rights Manager was found to be susceptible to a pre-authentication remote code execution vulnerability. If exploited, this vulnerability allows an unauthenticated user to run commands and executables.

CVSS 3.1 · 9.6 Critical EPSS 1.2% KEV · Not listed
Vendors
Solarwinds
Products
Access Rights Manager
CVE-2024-23468

SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability

The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.

CVSS 3.1 · 7.6 High EPSS 3.4% KEV · Not listed
Vendors
Solarwinds
Products
Access Rights Manager
CVE-2024-23465

SolarWinds Access Rights Manager (ARM) ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability

The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user to gain domain admin access within the Active Directory environment.  

CVSS 3.1 · 8.3 High EPSS 1.9% KEV · Not listed
Vendors
Solarwinds
Products
Access Rights Manager
CVE-2024-23448

APM Server Insertion of Sensitive Information into Log File

An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Apm Server
CVE-2024-23446

Kibana Broken Access Control issue

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2024-23443

kibana: uncontrolled resource consumption

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.

CVSS 3.1 · 4.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2024-23442

Kibana open redirect issue

An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Kibana
CVE-2024-23368

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Qualcomm IPC

Memory corruption when allocating and accessing an entry in an SMEM partition.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
Apq8064au Apq8064au Firmware Aqt1000 and 683 more
CVE-2024-23341

TuiTse-TsuSin html injection vulnerability in `tuitse_html` function

TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using `tuitse_html` without quoting the input, there is a html injection vulnerability. Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi input with HTML quotation.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ithuan
Products
Tuitse-tsusin
CVE-2024-23326

Envoy incorrectly accepts HTTP 200 response for entering upgrade mode

Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2024-23325

Envoy crashes when using an address type that isn’t supported by the OS

Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an address type that isn’t supported by the OS. Envoy is susceptible to crashing on a host with IPv6 disabled and a listener config with proxy protocol enabled when it receives a request where the client presents its IPv6 address. It is valid for a client to present its IPv6 address to a target server even though the whole chain is connected via IPv4. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Envoyproxy
Products
Envoy
CVE-2024-23324

Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata

Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Envoyproxy
Products
Envoy
CVE-2024-23323

Excessive CPU usage when URI template matcher is configured using regex in Envoy

Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Envoyproxy
Products
Envoy
CVE-2024-23322

Envoy crashes when idle and request per try timeout occur within the backoff interval

Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is enabled, 2. per_try_idle_timeout is enabled (it can only be done in configuration), 3. per-try-timeout is enabled, either through headers or configuration and its value is equal, or within the backoff interval of the per_try_idle_timeout. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Envoyproxy
Products
Envoy
CVE-2024-23319

CSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)

Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Server