CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Qlik Sense Enterprise for Windows HTTP Request Tunneling Remote Code Execution Vulnerability (CVE-2023-48365)
[Affected Scope] Qlik Sense Enterprise for Windows (prior to specified patch levels)
[Impact] Unauthenticated remote attackers can elevate privileges and execute arbitrary code on the backend repository server via HTTP request tunneling.
[Mitigation] Immediately apply the official security patches (August 2023 Patch 2 or later, etc.) provided by the vendor.
Qlik Sense Enterprise for Windows HTTP Request Tunneling & Privilege Escalation Vulnerability (CVE-2023-41265) Security Advisory
[Affected Scope] Qlik Sense Enterprise for Windows (May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier)
[Impact] A remote attacker can elevate privileges and execute unauthorized commands on the backend repository application by tunneling malicious HTTP requests.
[Mitigation] Immediately upgrade to the patched versions: August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13.
SAP NetWeaver and Web Dispatcher HTTP Request Smuggling Vulnerability (CVE-2022-22536) Security Advisory
[Affected Scope] SAP NetWeaver AS ABAP, AS Java, ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher
[Impact] Unauthenticated attackers can prepend arbitrary data to a victim's request, enabling session hijacking, cache poisoning, and complete compromise of system Confidentiality, Integrity, and Availability
[Mitigation] Immediately apply the official SAP security patches (SAP Note 3123396) and restrict anomalous HTTP request headers at the reverse proxy or WAF level