Overview 919 matches · 63 in Waratek scope · 28 protected · 26 exploited · 11 CISA KEV · 84 public PoC · 32 EPSS ≥ 0.5
919matches
63in Waratek scope6.9%
28protected3.0%
26exploited2.8%
11CISA KEV1.2%
84public PoC9.1%
32EPSS ≥ 0.53.5%
Protected by Waratek
28
3.0%
Rule in development
0
0.0%
Mitigation candidate
2
0.2%
No exploit published
33
3.6%
Outside Waratek scope
11
1.2%
Not applicable
845
91.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
28
3.0%
partly blocked
0
0.0%
not blocked
891
97.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 132 / year
20004
Not applicable4
High2
Medium2
not blocked4
Working exploit published3
No public exploit1
20011
Not applicable1
High1
not blocked1
No public exploit1
20022
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20030
20043
Outside Waratek scope1
Not applicable2
High3
not blocked3
Working exploit published2
No public exploit1
20057
Not applicable7
High4
Medium3
not blocked7
Exploited1
No public exploit6
20069
Not applicable9
High5
Medium3
Low1
not blocked9
Exploited1
Working exploit published4
No public exploit4
200716
Not applicable16
High8
Medium8
not blocked16
Exploited1
Working exploit published8
No public exploit7
200817
Not applicable17
High14
Medium3
not blocked17
Exploited1
Working exploit published7
No public exploit9
200921
Not applicable21
High17
Medium4
not blocked21
Exploited3
Working exploit published8
No public exploit10
20106
Not applicable6
High3
Medium2
Low1
not blocked6
Working exploit published1
No public exploit5
201120
Not applicable20
High13
Medium7
not blocked20
Working exploit published3
No public exploit17
20129
Not applicable9
High3
Medium6
not blocked9
Working exploit published1
No public exploit8
201320
Not applicable20
High7
Medium11
Low2
not blocked20
Working exploit published2
No public exploit18
201415
Not applicable15
Critical3
High4
Medium8
not blocked15
Exploited3
Working exploit published1
No public exploit11
20158
No exploit published2
Not applicable6
High3
Medium4
Low1
not blocked8
No public exploit8
20167
Protected by Waratek1
Not applicable6
Critical2
High4
Medium1
blocked by ARMR today1
not blocked6
No public exploit7
201718
Protected by Waratek1
Outside Waratek scope1
Not applicable16
Critical6
High5
Medium7
blocked by ARMR today1
not blocked17
Working exploit published1
No public exploit17
201839
Protected by Waratek2
No exploit published1
Outside Waratek scope2
Not applicable34
Critical6
High22
Medium11
blocked by ARMR today2
not blocked37
Exploited3
Working exploit published4
No public exploit32
201946
Protected by Waratek6
Outside Waratek scope1
Not applicable39
Critical5
High24
Medium17
blocked by ARMR today6
not blocked40
Exploited2
Working exploit published4
Proof of concept only1
Forecast only1
No public exploit38
202089
Protected by Waratek5
No exploit published7
Outside Waratek scope3
Not applicable74
Critical4
High63
Medium20
Low2
blocked by ARMR today5
not blocked84
Exploited1
Working exploit published1
No public exploit87
2021102
Protected by Waratek7
No exploit published11
Outside Waratek scope1
Not applicable83
Critical6
High73
Medium20
Low3
blocked by ARMR today7
not blocked95
Exploited6
Working exploit published1
Proof of concept only1
Forecast only3
No public exploit91
202276
Protected by Waratek4
Mitigation candidate1
No exploit published8
Outside Waratek scope1
Not applicable62
Critical6
High53
Medium16
Low1
blocked by ARMR today4
not blocked72
Exploited1
Working exploit published2
Proof of concept only4
No public exploit69
2023113
Protected by Waratek1
Mitigation candidate1
No exploit published2
Not applicable109
Critical14
High74
Medium24
Low1
blocked by ARMR today1
not blocked112
Exploited2
Working exploit published2
Proof of concept only12
Forecast only1
No public exploit96
202487
No exploit published1
Not applicable86
Critical7
High60
Medium19
Low1
not blocked87
Working exploit published1
Proof of concept only8
No public exploit78
202552
Protected by Waratek1
No exploit published1
Not applicable50
Critical7
High34
Medium11
blocked by ARMR today1
not blocked51
Working exploit published3
Proof of concept only6
No public exploit43
2026132
Outside Waratek scope1
Not applicable131
Critical10
High86
Medium34
Low2
not blocked132
Exploited1
Proof of concept only22
No public exploit109
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-49340 | High | 2024-10-16 | Not applicable | No public exploit | IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. |
| CVE-2024-9046 | High | 2024-10-11 | Not applicable | No public exploit | A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges. |
| CVE-2024-43610 | High | 2024-10-09 | Not applicable | No public exploit | Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector |
| CVE-2024-43603 | Medium | 2024-10-08 | Not applicable | No public exploit | Visual Studio Collector Service Denial of Service Vulnerability |
| CVE-2024-43601 | High | 2024-10-08 | Not applicable | No public exploit | Visual Studio Code for Linux Remote Code Execution Vulnerability |
| CVE-2024-43590 | High | 2024-10-08 | Not applicable | No public exploit | Visual C++ Redistributable Installer Elevation of Privilege Vulnerability |
| CVE-2024-43488 | Critical | 2024-10-08 | Not applicable | No public exploit | Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector. |
| CVE-2024-43485 | High | 2024-10-08 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-43484 | High | 2024-10-08 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
| CVE-2024-43483 | High | 2024-10-08 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
| CVE-2024-38229 | High | 2024-10-08 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-38168 | High | 2024-08-13 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-38167 | Medium | 2024-08-13 | Not applicable | No public exploit | .NET and Visual Studio Information Disclosure Vulnerability |
| CVE-2024-38206 | High | 2024-08-06 | Not applicable | No public exploit | An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network. |
| CVE-2024-38095 | High | 2024-07-09 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-38081 | High | 2024-07-09 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2024-35264 | High | 2024-07-09 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-30105 | High | 2024-07-09 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2022-27540 | High | 2024-06-28 | Not applicable | No public exploit | A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability. |
| CVE-2024-5899 | Low | 2024-06-18 | Not applicable | No public exploit | When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This comes from the fact that both call the method ProjectBuilder.createProject which then calls ProjectManager.getInstance().createProject. This method, as its name suggests is intended to create a new project, not to import an existing one. We recommend upgrading to version 2024.06.04.0.2 or beyond for the IntelliJ, CLion and Android Studio Bazel plugins. |
| CVE-2024-2747 | High | 2024-06-12 | Not applicable | No public exploit | CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user replaces a trusted file name on the system and reboots the machine. |
| CVE-2024-30052 | Medium | 2024-06-11 | Not applicable | Proof of concept only | Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-29060 | Medium | 2024-06-11 | Not applicable | No public exploit | Visual Studio Elevation of Privilege Vulnerability |
| CVE-2022-37020 | Medium | 2024-06-10 | Not applicable | No public exploit | Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities. |
| CVE-2022-37019 | Medium | 2024-06-10 | Not applicable | No public exploit | Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities. |
| CVE-2024-30046 | Medium | 2024-05-14 | Not applicable | No public exploit | Visual Studio Denial of Service Vulnerability |
| CVE-2024-30045 | Medium | 2024-05-14 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2021-22280 | High | 2024-05-14 | Not applicable | No public exploit | Improper DLL loading algorithms in B&R Automation Studio versions >=4.0 and <4.12 may allow an authenticated local attacker to execute code in the context of the product. |
| CVE-2024-29219 | High | 2024-04-15 | Not applicable | No public exploit | Out-of-bounds read vulnerability exists in KV STUDIO Ver.11.64 and earlier and KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6.02 and earlier, which may lead to information disclosure or arbitrary code execution by having a user of the affected product open a specially crafted file. |
| CVE-2024-29218 | High | 2024-04-15 | Not applicable | No public exploit | Out-of-bounds write vulnerability exists in KV STUDIO Ver.11.64 and earlier, KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6.02 and earlier, which may lead to information disclosure or arbitrary code execution by having a user of the affected product open a specially crafted file. |
| CVE-2024-28099 | High | 2024-04-15 | Not applicable | No public exploit | VT STUDIO Ver.8.32 and earlier contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privileges of the running application. |
| CVE-2024-28938 | High | 2024-04-09 | Not applicable | Proof of concept only | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-28937 | High | 2024-04-09 | Not applicable | No public exploit | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-28936 | High | 2024-04-09 | Not applicable | No public exploit | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-28935 | High | 2024-04-09 | Not applicable | No public exploit | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-28934 | High | 2024-04-09 | Not applicable | No public exploit | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-28933 | High | 2024-04-09 | Not applicable | No public exploit | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-28932 | High | 2024-04-09 | Not applicable | No public exploit | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-28931 | High | 2024-04-09 | Not applicable | No public exploit | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-28930 | High | 2024-04-09 | Not applicable | No public exploit | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-28929 | High | 2024-04-09 | Not applicable | No public exploit | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-21409 | High | 2024-04-09 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-2249 | Medium | 2024-03-14 | Not applicable | No public exploit | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute found in several widgets in all versions up to, and including, 1.3.7.4 due to insufficient input sanitization and output escaping the user supplied attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-26203 | High | 2024-03-12 | Not applicable | No public exploit | Azure Data Studio Elevation of Privilege Vulnerability |
| CVE-2024-26190 | High | 2024-03-12 | Not applicable | No public exploit | Microsoft QUIC Denial of Service Vulnerability |
| CVE-2024-26165 | High | 2024-03-12 | Not applicable | No public exploit | Visual Studio Code Elevation of Privilege Vulnerability |
| CVE-2024-21392 | High | 2024-03-12 | Not applicable | Proof of concept only | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-26152 | Medium | 2024-02-22 | Not applicable | Proof of concept only | ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Choices`](https://labelstud.io/tags/choices) or [`Labels`](https://labelstud.io/tags/labels) tag, resulting in an XSS vulnerability. ### Details Need permission to use the "data import" function. This was reproduced on Label Studio 1.10.1. ### PoC 1. Create a project.  2. Upload a file containing the payload using the "Upload Files" function.   The following are the contents of the files used in the PoC ``` { "data": { "prompt": "labelstudio universe image", "images": [ { "value": "id123#0", "style": "margin: 5px", "html": "<img width='400' src='https://labelstud.io/_astro/images-tab.64279c16_ZaBSvC.avif' onload=alert(document.cookie)>" } ] } } ``` 3. Select the text-to-image generation labeling template of Ranking and scoring   4. Select a task  5. Check that the script is running  ### Impact Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering. |
| CVE-2024-0220 | High | 2024-02-22 | Not applicable | No public exploit | B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data. |
| CVE-2024-21404 | High | 2024-02-13 | Not applicable | Proof of concept only | .NET Denial of Service Vulnerability |
| CVE-2024-21386 | High | 2024-02-13 | Not applicable | No public exploit | .NET Denial of Service Vulnerability |
| CVE-2021-22282 | High | 2024-02-02 | Not applicable | No public exploit | Improper Control of Generation of Code ('Code Injection') vulnerability in B&R Industrial Automation Automation Studio allows Local Execution of Code.This issue affects Automation Studio: from 4.0 through 4.12. |
| CVE-2021-22281 | High | 2024-02-02 | Not applicable | No public exploit | : Relative Path Traversal vulnerability in B&R Industrial Automation Automation Studio allows Relative Path Traversal.This issue affects Automation Studio: from 4.0 through 4.12. |
| CVE-2020-24682 | High | 2024-02-02 | Not applicable | No public exploit | Unquoted Search Path or Element vulnerability in B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI allows Target Programs with Elevated Privileges.This issue affects Automation Studio: from 4.0 through 4.6, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP; NET/PVI: from 4.0 through 4.6, from 4.7.0 before 4.7.7, from 4.8.0 before 4.8.6, from 4.9.0 before 4.9.4. |
| CVE-2020-24681 | High | 2024-02-02 | Not applicable | No public exploit | Incorrect Permission Assignment for Critical Resource vulnerability in B&R Industrial Automation Automation Studio allows Privilege Escalation.This issue affects Automation Studio: from 4.6.0 through 4.6.X, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP. |
| CVE-2024-1167 | High | 2024-02-01 | Not applicable | No public exploit | When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur. |
| CVE-2023-6078 | Critical | 2024-02-01 | Not applicable | No public exploit | An OS Command Injection vulnerability exists in BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023. Upload of a specially crafted perl script can lead to arbitrary command execution. |
| CVE-2024-0833 | High | 2024-01-31 | Not applicable | No public exploit | In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system. |
| CVE-2023-47116 | Medium | 2024-01-31 | Not applicable | Proof of concept only | Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the `SSRF_PROTECTION_ENABLED` environment variable can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to verify that the IP address is not in an excluded subnet range. This protection can be bypassed by either using HTTP redirection or performing a DNS rebinding attack. |
| CVE-2024-23633 | Medium | 2024-01-24 | Not applicable | Proof of concept only | Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious JavaScript code in the context of the Label Studio website. Executing arbitrary JavaScript could result in an attacker performing malicious actions on Label Studio users if they visit the crafted avatar image. For an example, an attacker can craft a JavaScript payload that adds a new Django Super Administrator user if a Django administrator visits the image. `data_import/uploader.py` lines 125C5 through 146 showed that if a URL passed the server side request forgery verification checks, the contents of the file would be downloaded using the filename in the URL. The downloaded file path could then be retrieved by sending a request to `/api/projects/{project_id}/file-uploads?ids=[{download_id}]` where `{project_id}` was the ID of the project and `{download_id}` was the ID of the downloaded file. Once the downloaded file path was retrieved by the previous API endpoint, `data_import/api.py`lines 595C1 through 616C62 demonstrated that the `Content-Type` of the response was determined by the file extension, since `mimetypes.guess_type` guesses the `Content-Type` based on the file extension. Since the `Content-Type` was determined by the file extension of the downloaded file, an attacker could import in a `.html` file that would execute JavaScript when visited. Version 1.10.1 contains a patch for this issue. Other remediation strategies are also available. For all user provided files that are downloaded by Label Studio, set the `Content-Security-Policy: sandbox;` response header when viewed on the site. The `sandbox` directive restricts a page's actions to prevent popups, execution of plugins and scripts and enforces a `same-origin` policy. Alternatively, restrict the allowed file extensions that may be downloaded. |
| CVE-2023-47115 | High | 2024-01-23 | Not applicable | Working exploit published | Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting (XSS) vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary JavaScript could result in an attacker performing malicious actions on Label Studio users if they visit the crafted avatar image. For an example, an attacker can craft a JavaScript payload that adds a new Django Super Administrator user if a Django administrator visits the image. The file `users/functions.py` lines 18-49 show that the only verification check is that the file is an image by extracting the dimensions from the file. Label Studio serves avatar images using Django's built-in `serve` view, which is not secure for production use according to Django's documentation. The issue with the Django `serve` view is that it determines the `Content-Type` of the response by the file extension in the URL path. Therefore, an attacker can upload an image that contains malicious HTML code and name the file with a `.html` extension to be rendered as a HTML page. The only file extension validation is performed on the client-side, which can be easily bypassed. Version 1.9.2 fixes this issue. Other remediation strategies include validating the file extension on the server side, not in client-side code; removing the use of Django's `serve` view and implement a secure controller for viewing uploaded avatar images; saving file content in the database rather than on the filesystem to mitigate against other file related vulnerabilities; and avoiding trusting user controlled inputs. |
| CVE-2022-45792 | High | 2024-01-22 | Not applicable | No public exploit | Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting files with the privileges of the logged-in user. |
| CVE-2024-23347 | High | 2024-01-16 | Not applicable | No public exploit | Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application. |
| CVE-2022-45793 | High | 2024-01-10 | Not applicable | No public exploit | Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user. |
| CVE-2024-21319 | Medium | 2024-01-09 | Not applicable | No public exploit | Microsoft Identity Denial of service vulnerability |
| CVE-2024-20656 | High | 2024-01-09 | Not applicable | Proof of concept only | Visual Studio Elevation of Privilege Vulnerability |
| CVE-2024-0057 | Critical | 2024-01-09 | Not applicable | No public exploit | NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability |
| CVE-2024-0056 | High | 2024-01-09 | Not applicable | No public exploit | Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability |
| CVE-2023-7032 | High | 2024-01-09 | Not applicable | No public exploit | A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges by providing a harmful serialized object. |
| CVE-2023-51717 | Critical | 2024-01-09 | Not applicable | No public exploit | Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass. |
| CVE-2018-25097 | Medium | 2024-01-02 | Not applicable | No public exploit | A vulnerability, which was classified as problematic, was found in Acumos Design Studio up to 2.0.7. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The name of the patch is 0df8a5e8722188744973168648e4c74c69ce67fd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249420. |
| CVE-2023-41613 | High | 2023-12-04 | Not applicable | Proof of concept only | EzViz Studio v2.2.0 is vulnerable to DLL hijacking. |
| CVE-2023-36558 | Medium | 2023-11-14 | Not applicable | Proof of concept only | ASP.NET Core Security Feature Bypass Vulnerability |
| CVE-2023-36049 | Critical | 2023-11-14 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-36042 | Medium | 2023-11-14 | Not applicable | No public exploit | Visual Studio Denial of Service Vulnerability |
| CVE-2023-36038 | High | 2023-11-14 | Not applicable | Proof of concept only | ASP.NET Core Denial of Service Vulnerability |
| CVE-2023-47117 | High | 2023-11-13 | Not applicable | Working exploit published | Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by character. In addition, Label Studio had a hard coded secret key that an attacker can use to forge a session token of any user by exploiting this ORM Leak vulnerability to leak account password hashes. This vulnerability has been addressed in commit `f931d9d129` which is included in the 1.9.2post0 release. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| CVE-2023-43791 | Critical | 2023-11-09 | Not applicable | Proof of concept only | Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced. |
| CVE-2023-42138 | High | 2023-10-11 | Not applicable | No public exploit | Out-of-bounds read vulnerability exists in KV STUDIO Ver. 11.62 and earlier and KV REPLAY VIEWER Ver. 2.62 and earlier. If this vulnerability is exploited, information may be disclosed or arbitrary code may be executed by having a user of KV STUDIO PLAYER open a specially crafted file. |
| CVE-2023-44487 | High | 2023-10-10 | Mitigation candidate | Exploited | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
| CVE-2023-38171 | High | 2023-10-10 | Not applicable | Forecast only | Microsoft QUIC Denial of Service Vulnerability |
| CVE-2023-36418 | High | 2023-10-10 | Not applicable | No public exploit | Azure RTOS GUIX Studio Remote Code Execution Vulnerability |
| CVE-2023-36799 | Medium | 2023-09-12 | Not applicable | No public exploit | .NET Core and Visual Studio Denial of Service Vulnerability |
| CVE-2023-36796 | High | 2023-09-12 | Not applicable | No public exploit | Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36794 | High | 2023-09-12 | Not applicable | No public exploit | Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36793 | High | 2023-09-12 | Not applicable | No public exploit | Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36792 | High | 2023-09-12 | Not applicable | No public exploit | Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36759 | Medium | 2023-09-12 | Not applicable | No public exploit | Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-36758 | Critical | 2023-09-12 | Not applicable | No public exploit | Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-36742 | High | 2023-09-12 | Not applicable | No public exploit | Visual Studio Code Remote Code Execution Vulnerability |
| CVE-2023-41329 | Medium | 2023-09-06 | No exploit published | No public exploit | WireMock is a tool for mocking HTTP services. The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured using the domain names, and in such a case the configuration is vulnerable to the DNS rebinding attacks. A similar patch was applied in WireMock 3.0.0-beta-15 for the WireMock Webhook Extensions. The root cause of the attack is a defect in the logic which allows for a race condition triggered by a DNS server whose address expires in between the initial validation and the outbound network request that might go to a domain that was supposed to be prohibited. Control over a DNS service is required to exploit this attack, so it has high execution complexity and limited impact. This issue has been addressed in version 2.35.1 of wiremock-jre8 and wiremock-jre8-standalone, version 3.0.3 of wiremock and wiremock-standalone, version 2.6.1 of the python version of wiremock, and versions 2.35.1-1 and 3.0.3-1 of the wiremock/wiremock Docker container. Users are advised to upgrade. Users unable to upgrade should either configure firewall rules to define the list of permitted destinations or to configure WireMock to use IP addresses instead of the domain names. |
| CVE-2023-41327 | Medium | 2023-09-06 | No exploit published | No public exploit | WireMock is a tool for mocking HTTP services. WireMock can be configured to only permit proxying (and therefore recording) to certain addresses. This is achieved via a list of allowed address rules and a list of denied address rules, where the allowed list is evaluated first. Until WireMock Webhooks Extension 3.0.0-beta-15, the filtering of target addresses from the proxy mode DID NOT work for Webhooks, so the users were potentially vulnerable regardless of the `limitProxyTargets` settings. Via the WireMock webhooks configuration, POST requests from a webhook might be forwarded to an arbitrary service reachable from WireMock’s instance. For example, If someone is running the WireMock docker Container inside a private cluster, they can trigger internal POST requests against unsecured APIs or even against secure ones by passing a token, discovered using another exploit, via authentication headers. This issue has been addressed in versions 2.35.1 and 3.0.3 of wiremock. Wiremock studio has been discontinued and will not see a fix. Users unable to upgrade should use external firewall rules to define the list of permitted destinations. |
| CVE-2023-39967 | Critical | 2023-09-06 | Not applicable | Proof of concept only | WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via “TestRequester” functionality, webhooks and the proxy mode. As we can control HTTP Method, HTTP Headers, HTTP Data, it allows sending requests with the default level of credentials for the WireMock instance. The vendor has discontinued the affected Wiremock studio product and there will be no fix. Users are advised to find alternatives. |
| CVE-2023-36088 | High | 2023-09-01 | Not applicable | Proof of concept only | Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information. |
| CVE-2023-24397 | Medium | 2023-08-30 | Not applicable | No public exploit | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Reservation.Studio Reservation.Studio widget plugin <= 1.0.11 versions. |
| CVE-2023-28823 | High | 2023-08-11 | Not applicable | No public exploit | Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2023-27391 | Medium | 2023-08-11 | Not applicable | No public exploit | Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow a privileged user to potentially enable escalation of privilege via local access. |
| CVE-2022-47636 | High | 2023-08-10 | Not applicable | Working exploit published | A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory av_libGLESv2.dll, libcef.DLL, user32.dll, and d3d10warp.dll. Using a crafted DLL, it is possible to execute arbitrary code in the context of the current logged in user. |
| CVE-2023-38180 | High | 2023-08-08 | Not applicable | Exploited | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2023-38178 | High | 2023-08-08 | Not applicable | No public exploit | .NET Core and Visual Studio Denial of Service Vulnerability |