| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration. |
| In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents. |
| In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents. |
| Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps. |
| Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop. |
| A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers. An authenticated remote attacker with low privileges could exploit insufficient bounds checking of user-supplied input, causing the web management service to become unresponsive. Restoring the service requires power cycling the affected device, while other device functions remain operational. |
| Tanium addressed a use-after-free vulnerability in Threat Response Client Extension. |
| Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension. |
| Tanium addressed an infinite loop vulnerability in Threat Response Client Extension. |
| Tanium addressed an information disclosure vulnerability in Threat Response Client Extension. |
| Tanium addressed an unauthorized code execution vulnerability in Threat Response. |
| Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response. |
| Tanium addressed an improper certificate validation vulnerability in Stream Client Extension. |
| Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation. |
| Tanium addressed an information disclosure vulnerability in Tanium Server. |
| Tanium addressed a denial of service vulnerability in Tanium Server. |
| Tanium addressed a heap-based buffer overflow vulnerability in Index. |
| Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| Tanium addressed an unauthorized code execution vulnerability in Certificate Manager. |
