#ExploitObserverAlert
GHSA-5jjq-8cvj-v6m9
DESCRIPTION: Exploit Observer has 3 entries in 3 file formats related to GHSA-5jjq-8cvj-v6m9. Cross-site Scripting in Serenity
GHSA-5jjq-8cvj-v6m9
DESCRIPTION: Exploit Observer has 3 entries in 3 file formats related to GHSA-5jjq-8cvj-v6m9. Cross-site Scripting in Serenity
#ExploitObserverAlert
CVE-2023-52433
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-52433. In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an already released object. Once transaction is finished, async GC will collect such expired element.
CVE-2023-52433
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-52433. In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an already released object. Once transaction is finished, async GC will collect such expired element.
#ExploitObserverAlert
CVE-2023-50306
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-50306. IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337.
CVE-2023-50306
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-50306. IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337.
#ExploitObserverAlert
GHSA-7496-fgv9-xw82
DESCRIPTION: Exploit Observer has 3 entries in 3 file formats related to GHSA-7496-fgv9-xw82. Unencrypted ingress/health traffic when using Wireguard transparent encryption
GHSA-7496-fgv9-xw82
DESCRIPTION: Exploit Observer has 3 entries in 3 file formats related to GHSA-7496-fgv9-xw82. Unencrypted ingress/health traffic when using Wireguard transparent encryption
#ExploitObserverAlert
CVE-2024-23606
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-23606. An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2024-23606
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-23606. An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
WLB-2024020062
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to WLB-2024020062. Employee Management System v.1.0 - SQL Injection.
WLB-2024020062
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to WLB-2024020062. Employee Management System v.1.0 - SQL Injection.
#ExploitObserverAlert
CVE-2024-21678
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-21678. This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, low impact to integrity, no impact to availability, and requires no user interaction. Data Center Atlassian recommends that Confluence Data Center customers upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||Affected versions||Fixed versions|| |from 8.7.0 to 8.7.1|8.8.0 recommended or 8.7.2| |from 8.6.0 to 8.6.1|8.8.0 recommended| |from 8.5.0 to 8.5.4 LTS|8.8.0 recommended or 8.5.5 LTS or 8.5.6 LTS| |from 8.4.0 to 8.4.5|8.8.0 recommended or 8.5.6 LTS| |from 8.3.0 to 8.3.4|8.8.0 recommended or 8.5.6 LTS| |from 8.2.0 to 8.2.3|8.8.0 recommended or 8.5.6 LTS| |from 8.1.0 to 8.1.4|8.8.0 recommended or 8.5.6 LTS| |from 8.0.0 to 8.0.4|8.8.0 recommended or 8.5.6 LTS| |from 7.20.0 to 7.20.3|8.8.0 recommended or 8.5.6 LTS| |from 7.19.0 to 7.19.17 LTS|8.8.0 recommended or 8.5.6 LTS or 7.19.18 LTS or 7.19.19 LTS| |from 7.18.0 to 7.18.3|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS| |from 7.17.0 to 7.17.5|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS| |Any earlier versions|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS| Server Atlassian recommends that Confluence Server customers upgrade to the latest 8.5.x LTS version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||Affected versions||Fixed versions|| |from 8.5.0 to 8.5.4 LTS|8.5.5 LTS or 8.5.6 LTS recommended | |from 8.4.0 to 8.4.5|8.5.6 LTS recommended| |from 8.3.0 to 8.3.4|8.5.6 LTS recommended| |from 8.2.0 to 8.2.3|8.5.6 LTS recommended| |from 8.1.0 to 8.1.4|8.5.6 LTS recommended| |from 8.0.0 to 8.0.4|8.5.6 LTS recommended| |from 7.20.0 to 7.20.3|8.5.6 LTS recommended| |from 7.19.0 to 7.19.17 LTS|8.5.6 LTS recommended or 7.19.18 LTS or 7.19.19 LTS| |from 7.18.0 to 7.18.3|8.5.6 LTS recommended or 7.19.19 LTS| |from 7.17.0 to 7.17.5|8.5.6 LTS recommended or 7.19.19 LTS| |Any earlier versions|8.5.6 LTS recommended or 7.19.19 LTS| See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Bug Bounty program.
CVE-2024-21678
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-21678. This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, low impact to integrity, no impact to availability, and requires no user interaction. Data Center Atlassian recommends that Confluence Data Center customers upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||Affected versions||Fixed versions|| |from 8.7.0 to 8.7.1|8.8.0 recommended or 8.7.2| |from 8.6.0 to 8.6.1|8.8.0 recommended| |from 8.5.0 to 8.5.4 LTS|8.8.0 recommended or 8.5.5 LTS or 8.5.6 LTS| |from 8.4.0 to 8.4.5|8.8.0 recommended or 8.5.6 LTS| |from 8.3.0 to 8.3.4|8.8.0 recommended or 8.5.6 LTS| |from 8.2.0 to 8.2.3|8.8.0 recommended or 8.5.6 LTS| |from 8.1.0 to 8.1.4|8.8.0 recommended or 8.5.6 LTS| |from 8.0.0 to 8.0.4|8.8.0 recommended or 8.5.6 LTS| |from 7.20.0 to 7.20.3|8.8.0 recommended or 8.5.6 LTS| |from 7.19.0 to 7.19.17 LTS|8.8.0 recommended or 8.5.6 LTS or 7.19.18 LTS or 7.19.19 LTS| |from 7.18.0 to 7.18.3|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS| |from 7.17.0 to 7.17.5|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS| |Any earlier versions|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS| Server Atlassian recommends that Confluence Server customers upgrade to the latest 8.5.x LTS version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||Affected versions||Fixed versions|| |from 8.5.0 to 8.5.4 LTS|8.5.5 LTS or 8.5.6 LTS recommended | |from 8.4.0 to 8.4.5|8.5.6 LTS recommended| |from 8.3.0 to 8.3.4|8.5.6 LTS recommended| |from 8.2.0 to 8.2.3|8.5.6 LTS recommended| |from 8.1.0 to 8.1.4|8.5.6 LTS recommended| |from 8.0.0 to 8.0.4|8.5.6 LTS recommended| |from 7.20.0 to 7.20.3|8.5.6 LTS recommended| |from 7.19.0 to 7.19.17 LTS|8.5.6 LTS recommended or 7.19.18 LTS or 7.19.19 LTS| |from 7.18.0 to 7.18.3|8.5.6 LTS recommended or 7.19.19 LTS| |from 7.17.0 to 7.17.5|8.5.6 LTS recommended or 7.19.19 LTS| |Any earlier versions|8.5.6 LTS recommended or 7.19.19 LTS| See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Bug Bounty program.
#ExploitObserverAlert
CVE-2023-49034
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-49034. Cross Site Scripting (XSS) vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files.
CVE-2023-49034
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-49034. Cross Site Scripting (XSS) vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files.
#ExploitObserverAlert
CVE-2024-25610
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-25610. In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field.
CVE-2024-25610
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-25610. In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field.
#ExploitObserverAlert
WLB-2024020068
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to WLB-2024020068. SPA-CART CMS - Stored XSS.
WLB-2024020068
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to WLB-2024020068. SPA-CART CMS - Stored XSS.
#ExploitObserverAlert
CVE-2024-1661
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-1661. A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254179. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-1661
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-1661. A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254179. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
#ExploitObserverAlert
CVE-2024-25199
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-25199. Inappropriate pointer order of map_sub_ and map_free(map_) (amcl_node.cpp) in Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions leads to a use-after-free.
CVE-2024-25199
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-25199. Inappropriate pointer order of map_sub_ and map_free(map_) (amcl_node.cpp) in Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions leads to a use-after-free.
#ExploitObserverAlert
CVE-2024-26581
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-26581. In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip end interval element from gc rbtree lazy gc on insert might collect an end interval element that has been just added in this transactions, skip end interval elements that are not yet active.
CVE-2024-26581
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-26581. In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip end interval element from gc rbtree lazy gc on insert might collect an end interval element that has been just added in this transactions, skip end interval elements that are not yet active.
#ExploitObserverAlert
CVE-2024-26270
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-26270. The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
CVE-2024-26270
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-26270. The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
#ExploitObserverAlert
CVE-2024-1156
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-1156. Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges.
CVE-2024-1156
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2024-1156. Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges.
#ExploitObserverAlert
TALOS-2024-1918
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to TALOS-2024-1918. Contact Cisco Talos Incident Response.
TALOS-2024-1918
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to TALOS-2024-1918. Contact Cisco Talos Incident Response.
#ExploitObserverAlert
TALOS-2024-1917
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to TALOS-2024-1917. Contact Cisco Talos Incident Response.
TALOS-2024-1917
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to TALOS-2024-1917. Contact Cisco Talos Incident Response.
#ExploitObserverAlert
GHSA-r275-j57c-7mf2
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to GHSA-r275-j57c-7mf2. Race condition in Endorsements
GHSA-r275-j57c-7mf2
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to GHSA-r275-j57c-7mf2. Race condition in Endorsements
#ExploitObserverAlert
WLB-2024020063
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to WLB-2024020063. Kafka UI 0.7.1 Command Injection.
WLB-2024020063
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to WLB-2024020063. Kafka UI 0.7.1 Command Injection.
#ExploitObserverAlert
GHSA-93x8-66j2-wwr5
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to GHSA-93x8-66j2-wwr5. Server-Side Request Forgery in github.com/greenpau/caddy-security
GHSA-93x8-66j2-wwr5
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to GHSA-93x8-66j2-wwr5. Server-Side Request Forgery in github.com/greenpau/caddy-security
#ExploitObserverAlert
CVE-2023-38562
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-38562. A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted set of network packets can lead to memory corruption, potentially resulting in code execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.
CVE-2023-38562
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-38562. A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted set of network packets can lead to memory corruption, potentially resulting in code execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.