Overview 243 matches · 20 in Waratek scope · 6 protected · 5 exploited · 0 CISA KEV · 25 public PoC · 2 EPSS ≥ 0.5
243matches
20in Waratek scope8.2%
6protected2.5%
5exploited2.1%
0CISA KEV0.0%
25public PoC10.3%
2EPSS ≥ 0.50.8%
Protected by Waratek
6
2.5%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
14
5.8%
Outside Waratek scope
5
2.1%
Not applicable
218
89.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
6
2.5%
partly blocked
0
0.0%
not blocked
237
97.5%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 34 / year
20002
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20010
20022
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20030
20040
20053
Not applicable3
Medium3
not blocked3
No public exploit3
20063
Not applicable3
Medium3
not blocked3
Exploited1
Working exploit published2
20078
Not applicable8
Medium8
not blocked8
Working exploit published5
No public exploit3
20083
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20094
Not applicable4
Medium4
not blocked4
Working exploit published2
No public exploit2
20102
Not applicable2
Medium2
not blocked2
No public exploit2
20117
Not applicable7
Medium7
not blocked7
Working exploit published1
No public exploit6
20126
Not applicable6
Medium6
not blocked6
No public exploit6
201311
Not applicable11
Medium11
not blocked11
No public exploit11
20148
Not applicable8
Medium8
not blocked8
Working exploit published1
No public exploit7
20154
No exploit published1
Not applicable3
Medium4
not blocked4
No public exploit4
20161
Not applicable1
Medium1
not blocked1
No public exploit1
20177
Not applicable7
Medium7
not blocked7
No public exploit7
201811
No exploit published1
Outside Waratek scope2
Not applicable8
Medium11
not blocked11
Exploited2
Working exploit published3
No public exploit6
201917
Protected by Waratek2
Not applicable15
Medium17
blocked by ARMR today2
not blocked15
Exploited1
No public exploit16
202020
No exploit published2
Outside Waratek scope2
Not applicable16
Medium20
not blocked20
No public exploit20
202120
Protected by Waratek3
No exploit published2
Outside Waratek scope1
Not applicable14
Medium20
blocked by ARMR today3
not blocked17
Exploited1
Proof of concept only1
No public exploit18
202216
Protected by Waratek1
No exploit published5
Not applicable10
Medium16
blocked by ARMR today1
not blocked15
Working exploit published1
Proof of concept only1
No public exploit14
202324
No exploit published2
Not applicable22
Medium24
not blocked24
Proof of concept only7
No public exploit17
202419
No exploit published1
Not applicable18
Medium19
not blocked19
Proof of concept only4
No public exploit15
202511
Not applicable11
Medium11
not blocked11
Working exploit published1
Proof of concept only1
No public exploit9
202634
Not applicable34
Medium34
not blocked34
Proof of concept only13
No public exploit21
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-85790 | Medium | 2026-10-13 | Not applicable | No public exploit | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-81380 | Medium | 2026-09-08 | Not applicable | No public exploit | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-81377 | Medium | 2026-09-08 | Not applicable | No public exploit | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. |
| CVE-2026-69304 | Medium | 2026-09-08 | Not applicable | No public exploit | Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-58649 | Medium | 2026-09-08 | Not applicable | No public exploit | Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-62902 | Medium | 2026-08-11 | Not applicable | No public exploit | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-62900 | Medium | 2026-08-11 | Not applicable | No public exploit | Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-62899 | Medium | 2026-08-11 | Not applicable | No public exploit | Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-47285 | Medium | 2026-08-11 | Not applicable | No public exploit | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-9108 | Medium | 2026-07-14 | Not applicable | No public exploit | A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution. |
| CVE-2026-50659 | Medium | 2026-07-14 | Not applicable | No public exploit | Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-47282 | Medium | 2026-07-14 | Not applicable | No public exploit | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-45496 | Medium | 2026-07-14 | Not applicable | No public exploit | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
| CVE-2026-9143 | Medium | 2026-06-19 | Not applicable | No public exploit | There is an incorrect conversion between numeric types vulnerability in NI grpc-device due to missing range checks in CodeGen. This may silently discard high bits if a size value exceeded the target type's range. This affects NI grpc-device 2.17.0 and prior versions. |
| CVE-2026-48141 | Medium | 2026-06-19 | Not applicable | No public exploit | There is a memory leak in NI grpc-device BeginSidebandStream that may result in denial of service due to memory exhaustion. This affects NI grpc-device 2.17.0 and prior versions. |
| CVE-2026-47287 | Medium | 2026-06-09 | Not applicable | No public exploit | Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. |
| CVE-2026-47284 | Medium | 2026-06-09 | Not applicable | No public exploit | Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-41610 | Medium | 2026-05-12 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
| CVE-2026-32175 | Medium | 2026-05-12 | Not applicable | No public exploit | A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files. |
| CVE-2019-25655 | Medium | 2026-03-30 | Not applicable | Proof of concept only | Device Monitoring Studio 8.10.00.8925 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the server connection dialog. Attackers can trigger the crash by entering a malformed server name or address containing repeated characters through the Tools menu Connect to New Server interface. |
| CVE-2018-25227 | Medium | 2026-03-30 | Not applicable | Proof of concept only | Valentina Studio 9.0.4 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Host field. Attackers can trigger the crash by pasting a 256-byte buffer of repeated characters into the Host parameter during server connection attempts. |
| CVE-2019-25625 | Medium | 2026-03-23 | Not applicable | Proof of concept only | Blob Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the key entry mechanism. Attackers can create a text file with a large buffer of repeated characters and trigger the application to read it, causing the application to crash or become unresponsive. |
| CVE-2019-25624 | Medium | 2026-03-23 | Not applicable | Proof of concept only | Liquid Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can trigger the vulnerability by entering arbitrary characters during application runtime, causing the application to become unresponsive or terminate abnormally. |
| CVE-2019-25623 | Medium | 2026-03-23 | Not applicable | Proof of concept only | Luminance Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can create a text file with arbitrary character sequences and trigger the application to process the input, causing the application to become unresponsive or terminate abnormally. |
| CVE-2019-25622 | Medium | 2026-03-23 | Not applicable | No public exploit | Paint Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the key entry mechanism. Attackers can create a text file with a large buffer of characters and trigger the application to read it, causing the application to crash and become unavailable. |
| CVE-2019-25621 | Medium | 2026-03-23 | Not applicable | Proof of concept only | Pixel Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can trigger the vulnerability by entering arbitrary characters, causing the application to become unresponsive or terminate abnormally. |
| CVE-2019-25620 | Medium | 2026-03-23 | Not applicable | Proof of concept only | Tree Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can trigger the vulnerability by entering arbitrary characters during application runtime, causing the application to become unresponsive or terminate abnormally. |
| CVE-2019-25567 | Medium | 2026-03-21 | Not applicable | Proof of concept only | Valentina Studio 9.0.5 Linux contains a buffer overflow vulnerability in the Host field of the connection dialog that allows local attackers to crash the application by supplying an oversized input string. Attackers can trigger the vulnerability by pasting a crafted buffer exceeding 264 bytes into the Host field during server connection attempts, causing a denial of service. |
| CVE-2019-25558 | Medium | 2026-03-21 | Not applicable | No public exploit | Selfie Studio 2.17 contains a denial of service vulnerability in the Resize Image function that allows local attackers to crash the application by supplying an excessively long buffer. Attackers can paste a large string of characters into the New Width or New Height field to trigger a buffer overflow that crashes the application. |
| CVE-2019-25557 | Medium | 2026-03-21 | Not applicable | Proof of concept only | TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability that allows local attackers to crash the application by importing a malformed .srp script file. Attackers can create a .srp file containing an excessively large buffer and import it through the Script Player interface to trigger an application crash. |
| CVE-2019-25556 | Medium | 2026-03-21 | Not applicable | Proof of concept only | TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability in the Resize Image function that allows local attackers to crash the application by supplying an excessively long buffer. Attackers can paste a malicious string into the New Width or New Height field to trigger a buffer overflow that causes the application to crash. |
| CVE-2019-25555 | Medium | 2026-03-21 | Not applicable | Proof of concept only | TwistedBrush Pro Studio 24.06 contains a denial of service vulnerability in the Script Recorder component that allows local attackers to crash the application by supplying an excessively large buffer. Attackers can paste a malicious string containing 500,000 characters into the Description field of the Script Recorder dialog to trigger an application crash. |
| CVE-2026-32104 | Medium | 2026-03-11 | Not applicable | Proof of concept only | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user's notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity. This vulnerability is fixed in 0.4.3. |
| CVE-2026-24134 | Medium | 2026-01-28 | Not applicable | Proof of concept only | StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by Editor/Admin/Owner users. Version 0.2.0 patches the issue. |
| CVE-2025-51962 | Medium | 2025-12-15 | Not applicable | No public exploit | A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrary web script or HTML via the text parameter of add_project_comment function. |
| CVE-2025-62453 | Medium | 2025-11-11 | Not applicable | No public exploit | Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally. |
| CVE-2025-62214 | Medium | 2025-11-11 | Not applicable | No public exploit | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally. |
| CVE-2025-55248 | Medium | 2025-10-14 | Not applicable | No public exploit | Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network. |
| CVE-2025-33116 | Medium | 2025-09-25 | Not applicable | No public exploit | IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
| CVE-2025-7427 | Medium | 2025-07-22 | Not applicable | No public exploit | Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful exploitation could lead to local arbitrary code execution in the context of the user running Arm Development Studio. |
| CVE-2025-5173 | Medium | 2025-05-26 | Not applicable | No public exploit | A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py of the component PT File Handler. The manipulation of the argument path leads to deserialization. An attack has to be approached locally. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. |
| CVE-2024-6712 | Medium | 2025-05-15 | Not applicable | Proof of concept only | The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack |
| CVE-2025-32703 | Medium | 2025-05-13 | Not applicable | No public exploit | Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally. |
| CVE-2025-32726 | Medium | 2025-04-12 | Not applicable | No public exploit | Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally. |
| CVE-2025-25296 | Medium | 2025-02-14 | Not applicable | Working exploit published | Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attacker can achieve Cross-Site Scripting (XSS). While the application has a Content Security Policy (CSP), it is only set in report-only mode, making it ineffective at preventing script execution. The vulnerability exists because the upload-example endpoint renders user-provided HTML content without proper sanitization on a GET request. This allows attackers to inject and execute arbitrary JavaScript in victims' browsers by getting them to visit a maliciously crafted URL. This is considered vulnerable because it enables attackers to execute JavaScript in victims' contexts, potentially allowing theft of sensitive data, session hijacking, or other malicious actions. Version 1.16.0 contains a patch for the issue. |
| CVE-2024-10787 | Medium | 2024-12-04 | Not applicable | No public exploit | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created by Elementor that they should not have access to. |
| CVE-2024-49044 | Medium | 2024-11-12 | Not applicable | No public exploit | Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-1932 | Medium | 2024-11-07 | No exploit published | No public exploit | A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks. |
| CVE-2024-48870 | Medium | 2024-10-25 | Not applicable | No public exploit | Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users. |
| CVE-2024-45842 | Medium | 2024-10-25 | Not applicable | No public exploit | Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. Unintended internal files may be retrieved when processing crafted HTTP requests. |
| CVE-2024-43603 | Medium | 2024-10-08 | Not applicable | No public exploit | Visual Studio Collector Service Denial of Service Vulnerability |
| CVE-2024-38167 | Medium | 2024-08-13 | Not applicable | No public exploit | .NET and Visual Studio Information Disclosure Vulnerability |
| CVE-2024-30052 | Medium | 2024-06-11 | Not applicable | Proof of concept only | Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-29060 | Medium | 2024-06-11 | Not applicable | No public exploit | Visual Studio Elevation of Privilege Vulnerability |
| CVE-2022-37020 | Medium | 2024-06-10 | Not applicable | No public exploit | Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities. |
| CVE-2022-37019 | Medium | 2024-06-10 | Not applicable | No public exploit | Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities. |
| CVE-2024-30046 | Medium | 2024-05-14 | Not applicable | No public exploit | Visual Studio Denial of Service Vulnerability |
| CVE-2024-30045 | Medium | 2024-05-14 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-2249 | Medium | 2024-03-14 | Not applicable | No public exploit | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute found in several widgets in all versions up to, and including, 1.3.7.4 due to insufficient input sanitization and output escaping the user supplied attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-26152 | Medium | 2024-02-22 | Not applicable | Proof of concept only | ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Choices`](https://labelstud.io/tags/choices) or [`Labels`](https://labelstud.io/tags/labels) tag, resulting in an XSS vulnerability. ### Details Need permission to use the "data import" function. This was reproduced on Label Studio 1.10.1. ### PoC 1. Create a project.  2. Upload a file containing the payload using the "Upload Files" function.   The following are the contents of the files used in the PoC ``` { "data": { "prompt": "labelstudio universe image", "images": [ { "value": "id123#0", "style": "margin: 5px", "html": "<img width='400' src='https://labelstud.io/_astro/images-tab.64279c16_ZaBSvC.avif' onload=alert(document.cookie)>" } ] } } ``` 3. Select the text-to-image generation labeling template of Ranking and scoring   4. Select a task  5. Check that the script is running  ### Impact Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering. |
| CVE-2023-47116 | Medium | 2024-01-31 | Not applicable | Proof of concept only | Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the `SSRF_PROTECTION_ENABLED` environment variable can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to verify that the IP address is not in an excluded subnet range. This protection can be bypassed by either using HTTP redirection or performing a DNS rebinding attack. |
| CVE-2024-23633 | Medium | 2024-01-24 | Not applicable | Proof of concept only | Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious JavaScript code in the context of the Label Studio website. Executing arbitrary JavaScript could result in an attacker performing malicious actions on Label Studio users if they visit the crafted avatar image. For an example, an attacker can craft a JavaScript payload that adds a new Django Super Administrator user if a Django administrator visits the image. `data_import/uploader.py` lines 125C5 through 146 showed that if a URL passed the server side request forgery verification checks, the contents of the file would be downloaded using the filename in the URL. The downloaded file path could then be retrieved by sending a request to `/api/projects/{project_id}/file-uploads?ids=[{download_id}]` where `{project_id}` was the ID of the project and `{download_id}` was the ID of the downloaded file. Once the downloaded file path was retrieved by the previous API endpoint, `data_import/api.py`lines 595C1 through 616C62 demonstrated that the `Content-Type` of the response was determined by the file extension, since `mimetypes.guess_type` guesses the `Content-Type` based on the file extension. Since the `Content-Type` was determined by the file extension of the downloaded file, an attacker could import in a `.html` file that would execute JavaScript when visited. Version 1.10.1 contains a patch for this issue. Other remediation strategies are also available. For all user provided files that are downloaded by Label Studio, set the `Content-Security-Policy: sandbox;` response header when viewed on the site. The `sandbox` directive restricts a page's actions to prevent popups, execution of plugins and scripts and enforces a `same-origin` policy. Alternatively, restrict the allowed file extensions that may be downloaded. |
| CVE-2024-21319 | Medium | 2024-01-09 | Not applicable | No public exploit | Microsoft Identity Denial of service vulnerability |
| CVE-2018-25097 | Medium | 2024-01-02 | Not applicable | No public exploit | A vulnerability, which was classified as problematic, was found in Acumos Design Studio up to 2.0.7. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The name of the patch is 0df8a5e8722188744973168648e4c74c69ce67fd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249420. |
| CVE-2023-36558 | Medium | 2023-11-14 | Not applicable | Proof of concept only | ASP.NET Core Security Feature Bypass Vulnerability |
| CVE-2023-36042 | Medium | 2023-11-14 | Not applicable | No public exploit | Visual Studio Denial of Service Vulnerability |
| CVE-2023-36799 | Medium | 2023-09-12 | Not applicable | No public exploit | .NET Core and Visual Studio Denial of Service Vulnerability |
| CVE-2023-36759 | Medium | 2023-09-12 | Not applicable | No public exploit | Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-41329 | Medium | 2023-09-06 | No exploit published | No public exploit | WireMock is a tool for mocking HTTP services. The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured using the domain names, and in such a case the configuration is vulnerable to the DNS rebinding attacks. A similar patch was applied in WireMock 3.0.0-beta-15 for the WireMock Webhook Extensions. The root cause of the attack is a defect in the logic which allows for a race condition triggered by a DNS server whose address expires in between the initial validation and the outbound network request that might go to a domain that was supposed to be prohibited. Control over a DNS service is required to exploit this attack, so it has high execution complexity and limited impact. This issue has been addressed in version 2.35.1 of wiremock-jre8 and wiremock-jre8-standalone, version 3.0.3 of wiremock and wiremock-standalone, version 2.6.1 of the python version of wiremock, and versions 2.35.1-1 and 3.0.3-1 of the wiremock/wiremock Docker container. Users are advised to upgrade. Users unable to upgrade should either configure firewall rules to define the list of permitted destinations or to configure WireMock to use IP addresses instead of the domain names. |
| CVE-2023-41327 | Medium | 2023-09-06 | No exploit published | No public exploit | WireMock is a tool for mocking HTTP services. WireMock can be configured to only permit proxying (and therefore recording) to certain addresses. This is achieved via a list of allowed address rules and a list of denied address rules, where the allowed list is evaluated first. Until WireMock Webhooks Extension 3.0.0-beta-15, the filtering of target addresses from the proxy mode DID NOT work for Webhooks, so the users were potentially vulnerable regardless of the `limitProxyTargets` settings. Via the WireMock webhooks configuration, POST requests from a webhook might be forwarded to an arbitrary service reachable from WireMock’s instance. For example, If someone is running the WireMock docker Container inside a private cluster, they can trigger internal POST requests against unsecured APIs or even against secure ones by passing a token, discovered using another exploit, via authentication headers. This issue has been addressed in versions 2.35.1 and 3.0.3 of wiremock. Wiremock studio has been discontinued and will not see a fix. Users unable to upgrade should use external firewall rules to define the list of permitted destinations. |
| CVE-2023-24397 | Medium | 2023-08-30 | Not applicable | No public exploit | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Reservation.Studio Reservation.Studio widget plugin <= 1.0.11 versions. |
| CVE-2023-27391 | Medium | 2023-08-11 | Not applicable | No public exploit | Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow a privileged user to potentially enable escalation of privilege via local access. |
| CVE-2023-38335 | Medium | 2023-07-20 | Not applicable | Proof of concept only | Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed to be an irreversible operation. However, due to implementation issues, "always private" Omnis libraries can be opened by the Omnis Studio browser by bypassing specific checks. This violates the expected behavior of an "irreversible operation". |
| CVE-2023-38334 | Medium | 2023-07-20 | Not applicable | Proof of concept only | Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it should be no longer possible to delete, view, change, copy, rename, duplicate, or print a locked class. Due to implementation issues, locked classes in Omnis libraries can be unlocked, and thus further analyzed and modified by Omnis Studio. This allows for further analyzing and also deleting, viewing, changing, copying, renaming, duplicating, or printing previously locked Omnis classes. This violates the expected behavior of an "irreversible operation." |
| CVE-2023-33144 | Medium | 2023-06-14 | Not applicable | No public exploit | Visual Studio Code Spoofing Vulnerability |
| CVE-2023-33139 | Medium | 2023-06-14 | Not applicable | No public exploit | Visual Studio Information Disclosure Vulnerability |
| CVE-2023-32032 | Medium | 2023-06-14 | Not applicable | Proof of concept only | .NET and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-29502 | Medium | 2023-06-07 | Not applicable | No public exploit | Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path. |
| CVE-2023-29338 | Medium | 2023-05-09 | Not applicable | Proof of concept only | Visual Studio Code Spoofing Vulnerability |
| CVE-2022-31643 | Medium | 2023-04-28 | Not applicable | No public exploit | A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity. HP is releasing firmware updates to mitigate the potential vulnerability. |
| CVE-2023-27425 | Medium | 2023-04-23 | Not applicable | No public exploit | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in James Irving-Swift Electric Studio Client Login plugin <= 0.8.1 versions. |
| CVE-2023-28299 | Medium | 2023-04-11 | Not applicable | No public exploit | Visual Studio Spoofing Vulnerability |
| CVE-2023-28263 | Medium | 2023-04-11 | Not applicable | No public exploit | Visual Studio Information Disclosure Vulnerability |
| CVE-2023-0500 | Medium | 2023-03-27 | Not applicable | Proof of concept only | The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack |
| CVE-2023-24045 | Medium | 2023-03-01 | Not applicable | Proof of concept only | In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download request. |
| CVE-2023-21567 | Medium | 2023-02-14 | Not applicable | No public exploit | Visual Studio Denial of Service Vulnerability |
| CVE-2022-47917 | Medium | 2023-01-18 | Not applicable | No public exploit | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to several modules and services of the software. This could allow an attacker to delete arbitrary files and cause a denial-of-service condition. |
| CVE-2022-43455 | Medium | 2023-01-18 | Not applicable | No public exploit | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to the service_start, service_stop, and service_restart modules of the software. This could allow an attacker to start, stop, or restart arbitrary services running on the server. |
| CVE-2022-4818 | Medium | 2022-12-28 | Not applicable | No public exploit | A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file org.talend.mdm.core/src/com/amalto/core/storage/SystemStorageWrapper.java. The manipulation leads to xml external entity reference. Upgrading to version 20221220_1938 is able to address this issue. The name of the patch is 95590db2ad6a582c371273ceab1a73ad6ed47853. It is recommended to upgrade the affected component. The identifier VDB-216997 was assigned to this vulnerability. |
| CVE-2022-36551 | Medium | 2022-10-03 | Not applicable | Working exploit published | A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF. |
| CVE-2022-34686 | Medium | 2022-08-09 | Not applicable | No public exploit | Azure RTOS GUIX Studio Information Disclosure Vulnerability |
| CVE-2022-34685 | Medium | 2022-08-09 | Not applicable | No public exploit | Azure RTOS GUIX Studio Information Disclosure Vulnerability |
| CVE-2022-1951 | Medium | 2022-07-11 | Not applicable | No public exploit | The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting. |
| CVE-2022-30184 | Medium | 2022-06-15 | Not applicable | No public exploit | .NET and Visual Studio Information Disclosure Vulnerability |
| CVE-2022-22976 | Medium | 2022-05-19 | No exploit published | No public exploit | Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE. |
| CVE-2022-22971 | Medium | 2022-05-12 | Protected by Waratek | No public exploit | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user. |
| CVE-2022-22970 | Medium | 2022-05-12 | No exploit published | No public exploit | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object. |
| CVE-2022-24823 | Medium | 2022-05-06 | No exploit published | Proof of concept only | Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user. |
| CVE-2022-22969 | Medium | 2022-04-21 | No exploit published | No public exploit | <Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only. |
| CVE-2022-24526 | Medium | 2022-03-09 | Not applicable | No public exploit | Visual Studio Code Spoofing Vulnerability |