CVE-2023-4663
published 2023-09-15CVE-2023-4663: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS. This issue affects…
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.79%
52.1th percentile
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS.
This issue affects Saphira Connect: before 9.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | connect | < 9.0 | 9.0 |
| saphira | saphira_connect | < 9 | 9 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vm6h-6m45-hfp7: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS
ghsa_unreviewed·2023-09-15
CVE-2023-4663 [MEDIUM] CWE-79 GHSA-vm6h-6m45-hfp7: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS.This issue affects Saphira Connect: before 9.
GHSA
Apollo has potential access control security issue in eureka
ghsa·2023-02-22
CVE-2023-25570 [HIGH] CWE-306 Apollo has potential access control security issue in eureka
Apollo has potential access control security issue in eureka
### Impact
If users expose the apollo-configservice to the internet (which is not recommended), there are potential security issues since there is no authentication feature enabled for the built-in eureka service. Malicious hackers may access eureka directly to mock apollo-configservice and apollo-adminservice .
### Patches
Login authentication for eureka was added in https://github.com/apolloconfig/apollo/pull/4663 and was released in [v2.1.0](https://github.com/apolloconfig/apollo/releases/tag/v2.1.0).
### Workarounds
To fix the potential issue without upgrading, simply follow the advice that does not expose apollo-configservice to the internet.
### References
[Apollo Security Guidence](https://www.apolloconfig.com/#/en/usa
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-09-15
Published