Security Vulnerabilities - CVEs Published In January 2024
A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. Affected by this issue is the function readRawText of the component HTTP Request Handler. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252290 is the identifier assigned to this vulnerability.
CVSS Score
6.3
EPSS Score
0.931
Published
2024-01-29
Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.
An authenticated AppBuilder user with the ability to create or manage existing databases can leverage them to exploit the AppBuilder server - including access to its local file system.
This issue affects AppBuilder: from 21.2 before 23.2.
CVSS Score
5.5
EPSS Score
0.001
Published
2024-01-29
Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.
AppBuilder configuration files are viewable by unauthenticated users.
This issue affects AppBuilder: from 21.2 before 23.2.
CVSS Score
5.3
EPSS Score
0.001
Published
2024-01-29
Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System Files.
AppBuilder's XML processor is vulnerable to XML External Entity Processing (XXE), allowing an authenticated user to upload specially crafted XML files to induce server-side request forgery, disclose files local to the server that processes them.
This issue affects AppBuilder: from 21.2 before 23.2.
CVSS Score
4.9
EPSS Score
0.0
Published
2024-01-29
Command injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote authenticated attacker to inject arbitrary commands onto the NAS as root.
CVSS Score
7.2
EPSS Score
0.01
Published
2024-01-29
Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.
An unauthenticated or authenticated user can abuse a page of AppBuilder to read arbitrary files on the server on which it is hosted.
This issue affects AppBuilder: from 21.2 before 23.2.
CVSS Score
7.5
EPSS Score
0.001
Published
2024-01-29
Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS Command Injection.
The AppBuilder's Scheduler functionality that facilitates creation of scheduled tasks is vulnerable to command injection. This allows authenticated users to inject arbitrary operating system commands into the executing process.
This issue affects AppBuilder: from 21.2 before 23.2.
CVSS Score
7.2
EPSS Score
0.001
Published
2024-01-29
DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.
CVSS Score
9.1
EPSS Score
0.001
Published
2024-01-29
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.
CVSS Score
9.8
EPSS Score
0.002
Published
2024-01-29
An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16.
CVSS Score
7.5
EPSS Score
0.002
Published
2024-01-29