NVD disclosure day

Published threat advisories for February 9, 2023

CVE-2023-0745

Yugabyte Anywhere Path Traversal Leading to Arbitrary File Write

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

Yugabyte Anywhere's High Availability feature has a vulnerability that allows arbitrary file writes through its backup upload endpoint by using path traversal characters. This could impact platform integrity and database clusters. Confirm relevance and assess potential exposure.

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2023-0758

JFinalOA SQL Injection Vulnerability Affects Glorylion JFinalOA 1.0.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical SQL injection vulnerability exists in JFinalOA, allowing unauthenticated remote attackers to manipulate database queries by exploiting the `id` argument. This could lead to unauthorized data access, modification, or deletion, impacting data integrity and confidentiality. Confirmation of any JFinalOA instance

NVD modified: NVD date unavailable