CVE Vulnerability Catalog

CVE-2023-38423 describes a cross-site scripting (XSS) vulnerability in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.

An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests.

Audit logs on F5OS-A may contain undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

OXID eShop Enterprise Edition versions 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header, leading to an HTTP Response Splitting attack.

The Shelly 4PM Pro four-channel smart switch version 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition, resulting in a device reload.

Verint Engagement Management version 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat.

In Liferay Portal versions 7.4.3.81 to 7.4.3.85 and Liferay DXP 7.4 updates 81 to 85, the organization selector does not check user permissions, allowing remote authenticated users to obtain a list of all organizations.

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'tab_date' and 'tab_date_r' parameters in versions up to and including 5.2.3 due to insufficient input sanitization and output escaping.

An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, and all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.

An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS.

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load.

An issue has been discovered in GitLab CE/EE affecting versions from 10.0 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams, allowing attackers to perform arbitrary actions on behalf of victims.

An issue has been discovered in GitLab affecting all versions from 8.10 before 16.0.8, all versions from 16.1 before 16.1.3, and all versions from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file.

An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus created by the Administrator.

Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project.

Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially serve malicious content to a user via a crafted background URL.

Insufficient validation of untrusted input in Chromad in Google Chrome on ChromeOS prior to version 115.0.5790.131 allowed a remote attacker to execute arbitrary code via a crafted shell script.

Inappropriate implementation in Autofill in Google Chrome prior to version 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page.

Inappropriate implementation in Notifications in Google Chrome prior to version 115.0.5790.98 allowed a remote attacker to spoof the contents of media notifications via a crafted HTML page.