Security Vulnerabilities - CVEs Published In February 2023
SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 2 of 2).
CVSS Score
5.4
EPSS Score
0.004
Published
2023-02-23
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
CVSS Score
7.5
EPSS Score
0.001
Published
2023-02-23
If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.
CVSS Score
6.1
EPSS Score
0.001
Published
2023-02-23
A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory.
CVSS Score
5.5
EPSS Score
0.0
Published
2023-02-23
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*. This issue is fixed in version 2.25.6. There are no workarounds.
CVSS Score
4.3
EPSS Score
0.002
Published
2023-02-23
In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.
CVSS Score
5.2
EPSS Score
0.0
Published
2023-02-23
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.
CVSS Score
5.4
EPSS Score
0.05
Published
2023-02-23
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.
CVSS Score
5.4
EPSS Score
0.001
Published
2023-02-23
A vulnerability classified as critical has been found in SourceCodester Sales Tracker Management System 1.0. This affects an unknown part of the file admin/?page=user/manage_user of the component Edit User. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-221679.
CVSS Score
6.3
EPSS Score
0.0
Published
2023-02-23
A vulnerability classified as problematic was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file index.php?page=checkout. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221680.
CVSS Score
3.5
EPSS Score
0.001
Published
2023-02-23