WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product studio✕
Overview 919 matches · 63 in Waratek scope · 28 protected · 26 exploited · 11 CISA KEV · 84 public PoC · 32 EPSS ≥ 0.5
split by peak 132 / year
Not applicable: 845Outside Waratek scope: 11No exploit published: 33Mitigation candidate: 2Protected by Waratek: 28 Low: 15Medium: 243High: 585Critical: 76 not blocked: 891blocked by ARMR today: 28 No public exploit: 774Forecast only: 5Proof of concept only: 54Working exploit published: 60Exploited: 26
20004 Not applicable4 High2 Medium2 not blocked4 Working exploit published3 No public exploit1 20011 Not applicable1 High1 not blocked1 No public exploit1 20022 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 20030 20043 Outside Waratek scope1 Not applicable2 High3 not blocked3 Working exploit published2 No public exploit1 20057 Not applicable7 High4 Medium3 not blocked7 Exploited1 No public exploit6 20069 Not applicable9 High5 Medium3 Low1 not blocked9 Exploited1 Working exploit published4 No public exploit4 200716 Not applicable16 High8 Medium8 not blocked16 Exploited1 Working exploit published8 No public exploit7 200817 Not applicable17 High14 Medium3 not blocked17 Exploited1 Working exploit published7 No public exploit9 200921 Not applicable21 High17 Medium4 not blocked21 Exploited3 Working exploit published8 No public exploit10 20106 Not applicable6 High3 Medium2 Low1 not blocked6 Working exploit published1 No public exploit5 201120 Not applicable20 High13 Medium7 not blocked20 Working exploit published3 No public exploit17 20129 Not applicable9 High3 Medium6 not blocked9 Working exploit published1 No public exploit8 201320 Not applicable20 High7 Medium11 Low2 not blocked20 Working exploit published2 No public exploit18 201415 Not applicable15 Critical3 High4 Medium8 not blocked15 Exploited3 Working exploit published1 No public exploit11 20158 No exploit published2 Not applicable6 High3 Medium4 Low1 not blocked8 No public exploit8 20167 Protected by Waratek1 Not applicable6 Critical2 High4 Medium1 blocked by ARMR today1 not blocked6 No public exploit7 201718 Protected by Waratek1 Outside Waratek scope1 Not applicable16 Critical6 High5 Medium7 blocked by ARMR today1 not blocked17 Working exploit published1 No public exploit17 201839 Protected by Waratek2 No exploit published1 Outside Waratek scope2 Not applicable34 Critical6 High22 Medium11 blocked by ARMR today2 not blocked37 Exploited3 Working exploit published4 No public exploit32 201946 Protected by Waratek6 Outside Waratek scope1 Not applicable39 Critical5 High24 Medium17 blocked by ARMR today6 not blocked40 Exploited2 Working exploit published4 Proof of concept only1 Forecast only1 No public exploit38 202089 Protected by Waratek5 No exploit published7 Outside Waratek scope3 Not applicable74 Critical4 High63 Medium20 Low2 blocked by ARMR today5 not blocked84 Exploited1 Working exploit published1 No public exploit87 2021102 Protected by Waratek7 No exploit published11 Outside Waratek scope1 Not applicable83 Critical6 High73 Medium20 Low3 blocked by ARMR today7 not blocked95 Exploited6 Working exploit published1 Proof of concept only1 Forecast only3 No public exploit91 202276 Protected by Waratek4 Mitigation candidate1 No exploit published8 Outside Waratek scope1 Not applicable62 Critical6 High53 Medium16 Low1 blocked by ARMR today4 not blocked72 Exploited1 Working exploit published2 Proof of concept only4 No public exploit69 2023113 Protected by Waratek1 Mitigation candidate1 No exploit published2 Not applicable109 Critical14 High74 Medium24 Low1 blocked by ARMR today1 not blocked112 Exploited2 Working exploit published2 Proof of concept only12 Forecast only1 No public exploit96 202487 No exploit published1 Not applicable86 Critical7 High60 Medium19 Low1 not blocked87 Working exploit published1 Proof of concept only8 No public exploit78 202552 Protected by Waratek1 No exploit published1 Not applicable50 Critical7 High34 Medium11 blocked by ARMR today1 not blocked51 Working exploit published3 Proof of concept only6 No public exploit43 2026132 Outside Waratek scope1 Not applicable131 Critical10 High86 Medium34 Low2 not blocked132 Exploited1 Proof of concept only22 No public exploit109
200220052008201120142017202020232026
919 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 10 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2024-49340 High 2024-10-16 Not applicable No public exploit IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVE-2024-9046 High 2024-10-11 Not applicable No public exploit A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges.
CVE-2024-43610 High 2024-10-09 Not applicable No public exploit Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector
CVE-2024-43603 Medium 2024-10-08 Not applicable No public exploit Visual Studio Collector Service Denial of Service Vulnerability
CVE-2024-43601 High 2024-10-08 Not applicable No public exploit Visual Studio Code for Linux Remote Code Execution Vulnerability
CVE-2024-43590 High 2024-10-08 Not applicable No public exploit Visual C++ Redistributable Installer Elevation of Privilege Vulnerability
CVE-2024-43488 Critical 2024-10-08 Not applicable No public exploit Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.
CVE-2024-43485 High 2024-10-08 Not applicable No public exploit .NET and Visual Studio Denial of Service Vulnerability
CVE-2024-43484 High 2024-10-08 Not applicable No public exploit .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
CVE-2024-43483 High 2024-10-08 Not applicable No public exploit .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
CVE-2024-38229 High 2024-10-08 Not applicable No public exploit .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2024-38168 High 2024-08-13 Not applicable No public exploit .NET and Visual Studio Denial of Service Vulnerability
CVE-2024-38167 Medium 2024-08-13 Not applicable No public exploit .NET and Visual Studio Information Disclosure Vulnerability
CVE-2024-38206 High 2024-08-06 Not applicable No public exploit An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.
CVE-2024-38095 High 2024-07-09 Not applicable No public exploit .NET and Visual Studio Denial of Service Vulnerability
CVE-2024-38081 High 2024-07-09 Not applicable No public exploit .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2024-35264 High 2024-07-09 Not applicable No public exploit .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2024-30105 High 2024-07-09 Not applicable No public exploit .NET and Visual Studio Denial of Service Vulnerability
CVE-2022-27540 High 2024-06-28 Not applicable No public exploit A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability.
CVE-2024-5899 Low 2024-06-18 Not applicable No public exploit When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This comes from the fact that both call the method ProjectBuilder.createProject which then calls ProjectManager.getInstance().createProject. This method, as its name suggests is intended to create a new project, not to import an existing one.  We recommend upgrading to version 2024.06.04.0.2 or beyond for the IntelliJ, CLion and Android Studio Bazel plugins.
CVE-2024-2747 High 2024-06-12 Not applicable No public exploit CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user replaces a trusted file name on the system and reboots the machine.
CVE-2024-30052 Medium 2024-06-11 Not applicable Proof of concept only Visual Studio Remote Code Execution Vulnerability
CVE-2024-29060 Medium 2024-06-11 Not applicable No public exploit Visual Studio Elevation of Privilege Vulnerability
CVE-2022-37020 Medium 2024-06-10 Not applicable No public exploit Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.
CVE-2022-37019 Medium 2024-06-10 Not applicable No public exploit Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.
CVE-2024-30046 Medium 2024-05-14 Not applicable No public exploit Visual Studio Denial of Service Vulnerability
CVE-2024-30045 Medium 2024-05-14 Not applicable No public exploit .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2021-22280 High 2024-05-14 Not applicable No public exploit Improper DLL loading algorithms in B&R Automation Studio versions >=4.0 and <4.12 may allow an authenticated local attacker to execute code in the context of the product.
CVE-2024-29219 High 2024-04-15 Not applicable No public exploit Out-of-bounds read vulnerability exists in KV STUDIO Ver.11.64 and earlier and KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6.02 and earlier, which may lead to information disclosure or arbitrary code execution by having a user of the affected product open a specially crafted file.
CVE-2024-29218 High 2024-04-15 Not applicable No public exploit Out-of-bounds write vulnerability exists in KV STUDIO Ver.11.64 and earlier, KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6.02 and earlier, which may lead to information disclosure or arbitrary code execution by having a user of the affected product open a specially crafted file.
CVE-2024-28099 High 2024-04-15 Not applicable No public exploit VT STUDIO Ver.8.32 and earlier contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privileges of the running application.
CVE-2024-28938 High 2024-04-09 Not applicable Proof of concept only Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-28937 High 2024-04-09 Not applicable No public exploit Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-28936 High 2024-04-09 Not applicable No public exploit Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-28935 High 2024-04-09 Not applicable No public exploit Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-28934 High 2024-04-09 Not applicable No public exploit Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-28933 High 2024-04-09 Not applicable No public exploit Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-28932 High 2024-04-09 Not applicable No public exploit Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-28931 High 2024-04-09 Not applicable No public exploit Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-28930 High 2024-04-09 Not applicable No public exploit Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-28929 High 2024-04-09 Not applicable No public exploit Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-21409 High 2024-04-09 Not applicable No public exploit .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2024-2249 Medium 2024-03-14 Not applicable No public exploit The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute found in several widgets in all versions up to, and including, 1.3.7.4 due to insufficient input sanitization and output escaping the user supplied attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-26203 High 2024-03-12 Not applicable No public exploit Azure Data Studio Elevation of Privilege Vulnerability
CVE-2024-26190 High 2024-03-12 Not applicable No public exploit Microsoft QUIC Denial of Service Vulnerability
CVE-2024-26165 High 2024-03-12 Not applicable No public exploit Visual Studio Code Elevation of Privilege Vulnerability
CVE-2024-21392 High 2024-03-12 Not applicable Proof of concept only .NET and Visual Studio Denial of Service Vulnerability
CVE-2024-26152 Medium 2024-02-22 Not applicable Proof of concept only ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Choices`](https://labelstud.io/tags/choices) or [`Labels`](https://labelstud.io/tags/labels) tag, resulting in an XSS vulnerability. ### Details Need permission to use the "data import" function. This was reproduced on Label Studio 1.10.1. ### PoC 1. Create a project. ![Create a project](https://github.com/HumanSignal/label-studio/assets/3943358/9b1536ad-feac-4238-a1bd-ca9b1b798673) 2. Upload a file containing the payload using the "Upload Files" function. ![2 Upload a file containing the payload using the Upload Files function](https://github.com/HumanSignal/label-studio/assets/3943358/26bb7af1-1cd2-408f-9adf-61e31a5b7328) ![3 complete](https://github.com/HumanSignal/label-studio/assets/3943358/f2f62774-1fa6-4456-9e6f-8fa1ca0a2d2e) The following are the contents of the files used in the PoC ``` { "data": { "prompt": "labelstudio universe image", "images": [ { "value": "id123#0", "style": "margin: 5px", "html": "<img width='400' src='https://labelstud.io/_astro/images-tab.64279c16_ZaBSvC.avif' onload=alert(document.cookie)>" } ] } } ``` 3. Select the text-to-image generation labeling template of Ranking and scoring ![3 Select the text-to-image generation labelling template for Ranking and scoring](https://github.com/HumanSignal/label-studio/assets/3943358/f227f49c-a718-4738-bc2a-807da4f97155) ![5 save](https://github.com/HumanSignal/label-studio/assets/3943358/9b529f8a-8e99-4bb0-bdf6-bb7a95c9b75d) 4. Select a task ![4 Select a task](https://github.com/HumanSignal/label-studio/assets/3943358/71856b7a-2b1f-44ea-99ab-fc48bc20caa7) 5. Check that the script is running ![5 Check that the script is running](https://github.com/HumanSignal/label-studio/assets/3943358/e396ae7b-a591-4db7-afe9-5bab30b48cb9) ### Impact Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.
CVE-2024-0220 High 2024-02-22 Not applicable No public exploit B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data.
CVE-2024-21404 High 2024-02-13 Not applicable Proof of concept only .NET Denial of Service Vulnerability
CVE-2024-21386 High 2024-02-13 Not applicable No public exploit .NET Denial of Service Vulnerability
CVE-2021-22282 High 2024-02-02 Not applicable No public exploit Improper Control of Generation of Code ('Code Injection') vulnerability in B&R Industrial Automation Automation Studio allows Local Execution of Code.This issue affects Automation Studio: from 4.0 through 4.12.
CVE-2021-22281 High 2024-02-02 Not applicable No public exploit : Relative Path Traversal vulnerability in B&R Industrial Automation Automation Studio allows Relative Path Traversal.This issue affects Automation Studio: from 4.0 through 4.12.
CVE-2020-24682 High 2024-02-02 Not applicable No public exploit Unquoted Search Path or Element vulnerability in B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI allows Target Programs with Elevated Privileges.This issue affects Automation Studio: from 4.0 through 4.6, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP; NET/PVI: from 4.0 through 4.6, from 4.7.0 before 4.7.7, from 4.8.0 before 4.8.6, from 4.9.0 before 4.9.4.
CVE-2020-24681 High 2024-02-02 Not applicable No public exploit Incorrect Permission Assignment for Critical Resource vulnerability in B&R Industrial Automation Automation Studio allows Privilege Escalation.This issue affects Automation Studio: from 4.6.0 through 4.6.X, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP.
CVE-2024-1167 High 2024-02-01 Not applicable No public exploit When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur.
CVE-2023-6078 Critical 2024-02-01 Not applicable No public exploit An OS Command Injection vulnerability exists in BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023. Upload of a specially crafted perl script can lead to arbitrary command execution.
CVE-2024-0833 High 2024-01-31 Not applicable No public exploit In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component.  In an environment where an existing Telerik Test Studio install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system.
CVE-2023-47116 Medium 2024-01-31 Not applicable Proof of concept only Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the `SSRF_PROTECTION_ENABLED` environment variable can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to verify that the IP address is not in an excluded subnet range. This protection can be bypassed by either using HTTP redirection or performing a DNS rebinding attack.
CVE-2024-23633 Medium 2024-01-24 Not applicable Proof of concept only Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious JavaScript code in the context of the Label Studio website. Executing arbitrary JavaScript could result in an attacker performing malicious actions on Label Studio users if they visit the crafted avatar image. For an example, an attacker can craft a JavaScript payload that adds a new Django Super Administrator user if a Django administrator visits the image. `data_import/uploader.py` lines 125C5 through 146 showed that if a URL passed the server side request forgery verification checks, the contents of the file would be downloaded using the filename in the URL. The downloaded file path could then be retrieved by sending a request to `/api/projects/{project_id}/file-uploads?ids=[{download_id}]` where `{project_id}` was the ID of the project and `{download_id}` was the ID of the downloaded file. Once the downloaded file path was retrieved by the previous API endpoint, `data_import/api.py`lines 595C1 through 616C62 demonstrated that the `Content-Type` of the response was determined by the file extension, since `mimetypes.guess_type` guesses the `Content-Type` based on the file extension. Since the `Content-Type` was determined by the file extension of the downloaded file, an attacker could import in a `.html` file that would execute JavaScript when visited. Version 1.10.1 contains a patch for this issue. Other remediation strategies are also available. For all user provided files that are downloaded by Label Studio, set the `Content-Security-Policy: sandbox;` response header when viewed on the site. The `sandbox` directive restricts a page's actions to prevent popups, execution of plugins and scripts and enforces a `same-origin` policy. Alternatively, restrict the allowed file extensions that may be downloaded.
CVE-2023-47115 High 2024-01-23 Not applicable Working exploit published Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting (XSS) vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary JavaScript could result in an attacker performing malicious actions on Label Studio users if they visit the crafted avatar image. For an example, an attacker can craft a JavaScript payload that adds a new Django Super Administrator user if a Django administrator visits the image. The file `users/functions.py` lines 18-49 show that the only verification check is that the file is an image by extracting the dimensions from the file. Label Studio serves avatar images using Django's built-in `serve` view, which is not secure for production use according to Django's documentation. The issue with the Django `serve` view is that it determines the `Content-Type` of the response by the file extension in the URL path. Therefore, an attacker can upload an image that contains malicious HTML code and name the file with a `.html` extension to be rendered as a HTML page. The only file extension validation is performed on the client-side, which can be easily bypassed. Version 1.9.2 fixes this issue. Other remediation strategies include validating the file extension on the server side, not in client-side code; removing the use of Django's `serve` view and implement a secure controller for viewing uploaded avatar images; saving file content in the database rather than on the filesystem to mitigate against other file related vulnerabilities; and avoiding trusting user controlled inputs.
CVE-2022-45792 High 2024-01-22 Not applicable No public exploit Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting files with the privileges of the logged-in user.
CVE-2024-23347 High 2024-01-16 Not applicable No public exploit Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application.
CVE-2022-45793 High 2024-01-10 Not applicable No public exploit Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user.
CVE-2024-21319 Medium 2024-01-09 Not applicable No public exploit Microsoft Identity Denial of service vulnerability
CVE-2024-20656 High 2024-01-09 Not applicable Proof of concept only Visual Studio Elevation of Privilege Vulnerability
CVE-2024-0057 Critical 2024-01-09 Not applicable No public exploit NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
CVE-2024-0056 High 2024-01-09 Not applicable No public exploit Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
CVE-2023-7032 High 2024-01-09 Not applicable No public exploit A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges by providing a harmful serialized object.
CVE-2023-51717 Critical 2024-01-09 Not applicable No public exploit Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.
CVE-2018-25097 Medium 2024-01-02 Not applicable No public exploit A vulnerability, which was classified as problematic, was found in Acumos Design Studio up to 2.0.7. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The name of the patch is 0df8a5e8722188744973168648e4c74c69ce67fd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249420.
CVE-2023-41613 High 2023-12-04 Not applicable Proof of concept only EzViz Studio v2.2.0 is vulnerable to DLL hijacking.
CVE-2023-36558 Medium 2023-11-14 Not applicable Proof of concept only ASP.NET Core Security Feature Bypass Vulnerability
CVE-2023-36049 Critical 2023-11-14 Not applicable No public exploit .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2023-36042 Medium 2023-11-14 Not applicable No public exploit Visual Studio Denial of Service Vulnerability
CVE-2023-36038 High 2023-11-14 Not applicable Proof of concept only ASP.NET Core Denial of Service Vulnerability
CVE-2023-47117 High 2023-11-13 Not applicable Working exploit published Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by character. In addition, Label Studio had a hard coded secret key that an attacker can use to forge a session token of any user by exploiting this ORM Leak vulnerability to leak account password hashes. This vulnerability has been addressed in commit `f931d9d129` which is included in the 1.9.2post0 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-43791 Critical 2023-11-09 Not applicable Proof of concept only Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced.
CVE-2023-42138 High 2023-10-11 Not applicable No public exploit Out-of-bounds read vulnerability exists in KV STUDIO Ver. 11.62 and earlier and KV REPLAY VIEWER Ver. 2.62 and earlier. If this vulnerability is exploited, information may be disclosed or arbitrary code may be executed by having a user of KV STUDIO PLAYER open a specially crafted file.
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2023-38171 High 2023-10-10 Not applicable Forecast only Microsoft QUIC Denial of Service Vulnerability
CVE-2023-36418 High 2023-10-10 Not applicable No public exploit Azure RTOS GUIX Studio Remote Code Execution Vulnerability
CVE-2023-36799 Medium 2023-09-12 Not applicable No public exploit .NET Core and Visual Studio Denial of Service Vulnerability
CVE-2023-36796 High 2023-09-12 Not applicable No public exploit Visual Studio Remote Code Execution Vulnerability
CVE-2023-36794 High 2023-09-12 Not applicable No public exploit Visual Studio Remote Code Execution Vulnerability
CVE-2023-36793 High 2023-09-12 Not applicable No public exploit Visual Studio Remote Code Execution Vulnerability
CVE-2023-36792 High 2023-09-12 Not applicable No public exploit Visual Studio Remote Code Execution Vulnerability
CVE-2023-36759 Medium 2023-09-12 Not applicable No public exploit Visual Studio Elevation of Privilege Vulnerability
CVE-2023-36758 Critical 2023-09-12 Not applicable No public exploit Visual Studio Elevation of Privilege Vulnerability
CVE-2023-36742 High 2023-09-12 Not applicable No public exploit Visual Studio Code Remote Code Execution Vulnerability
CVE-2023-41329 Medium 2023-09-06 No exploit published No public exploit WireMock is a tool for mocking HTTP services. The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured using the domain names, and in such a case the configuration is vulnerable to the DNS rebinding attacks. A similar patch was applied in WireMock 3.0.0-beta-15 for the WireMock Webhook Extensions. The root cause of the attack is a defect in the logic which allows for a race condition triggered by a DNS server whose address expires in between the initial validation and the outbound network request that might go to a domain that was supposed to be prohibited. Control over a DNS service is required to exploit this attack, so it has high execution complexity and limited impact. This issue has been addressed in version 2.35.1 of wiremock-jre8 and wiremock-jre8-standalone, version 3.0.3 of wiremock and wiremock-standalone, version 2.6.1 of the python version of wiremock, and versions 2.35.1-1 and 3.0.3-1 of the wiremock/wiremock Docker container. Users are advised to upgrade. Users unable to upgrade should either configure firewall rules to define the list of permitted destinations or to configure WireMock to use IP addresses instead of the domain names.
CVE-2023-41327 Medium 2023-09-06 No exploit published No public exploit WireMock is a tool for mocking HTTP services. WireMock can be configured to only permit proxying (and therefore recording) to certain addresses. This is achieved via a list of allowed address rules and a list of denied address rules, where the allowed list is evaluated first. Until WireMock Webhooks Extension 3.0.0-beta-15, the filtering of target addresses from the proxy mode DID NOT work for Webhooks, so the users were potentially vulnerable regardless of the `limitProxyTargets` settings. Via the WireMock webhooks configuration, POST requests from a webhook might be forwarded to an arbitrary service reachable from WireMock’s instance. For example, If someone is running the WireMock docker Container inside a private cluster, they can trigger internal POST requests against unsecured APIs or even against secure ones by passing a token, discovered using another exploit, via authentication headers. This issue has been addressed in versions 2.35.1 and 3.0.3 of wiremock. Wiremock studio has been discontinued and will not see a fix. Users unable to upgrade should use external firewall rules to define the list of permitted destinations.
CVE-2023-39967 Critical 2023-09-06 Not applicable Proof of concept only WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via “TestRequester” functionality, webhooks and the proxy mode. As we can control HTTP Method, HTTP Headers, HTTP Data, it allows sending requests with the default level of credentials for the WireMock instance. The vendor has discontinued the affected Wiremock studio product and there will be no fix. Users are advised to find alternatives.
CVE-2023-36088 High 2023-09-01 Not applicable Proof of concept only Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information.
CVE-2023-24397 Medium 2023-08-30 Not applicable No public exploit Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Reservation.Studio Reservation.Studio widget plugin <= 1.0.11 versions.
CVE-2023-28823 High 2023-08-11 Not applicable No public exploit Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-27391 Medium 2023-08-11 Not applicable No public exploit Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2022-47636 High 2023-08-10 Not applicable Working exploit published A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory av_libGLESv2.dll, libcef.DLL, user32.dll, and d3d10warp.dll. Using a crafted DLL, it is possible to execute arbitrary code in the context of the current logged in user.
CVE-2023-38180 High 2023-08-08 Not applicable Exploited .NET and Visual Studio Denial of Service Vulnerability
CVE-2023-38178 High 2023-08-08 Not applicable No public exploit .NET Core and Visual Studio Denial of Service Vulnerability
‹ prev page 3 of 10 next ›