CVE-2023-0203

CVE-2023-0203 affects NVIDIA ConnectX firmware on ConnectX-5, ConnectX-6, and ConnectX6-DX. The issue stems from insufficient granularity of access controls in the NIC firmware, enabling an unprivileged user to cause a denial of service. NVIDIA’s security bulletin lists CVE-2023-0203 with base sc...

PT-2023-16083 · Nvidia · Nvidia Connectx6-Dx +2

Name of the Vulnerable Software and Affected Versions: NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX affected versions not specified Description: The issue is related to improper handling of exceptional conditions in the NIC firmware, which may lead to denial of service. An unprivileged user ca...

PT-2023-16084 · Nvidia · Nvidia Connectx6-Dx +2

Name of the Vulnerable Software and Affected Versions: NVIDIA ConnectX-5 affected versions not specified NVIDIA ConnectX-6 affected versions not specified NVIDIA ConnectX6-DX affected versions not specified Description: The issue is related to insufficient granularity of access control in the NIC...

CVE-2023-0205: Insufficient Granularity of Access Control

NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service...

CVE-2023-0204: Improper Check or Handling of Exceptional Conditions

NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can cause improper handling of exceptional conditions, which may lead to denial of service...

CVE-2023-0203: Insufficient Granularity of Access Control

NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service...

CVE-2023-2017

Server-side Template Injection SSTI in Shopware 6 = v6.4.20.0, v6.5.0.0-rc1 = v6.5.0.0-rc4, affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in...

Input validation

Server-side Template Injection SSTI in Shopware 6 = v6.4.20.0, v6.5.0.0-rc1 = v6.5.0.0-rc4, affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in...

CVE-2023-2017

Shopware 6 experienced a regression of CVE-2023-2017 in versions 6.7.0.0 to before 6.7.6.1, where an array- and array-crafted PHP Closure could bypass allow-list checks for map(...) overrides in Twig rendered views. This reopens the security issue by not properly filtering generatedCode in Twig, ...

CVE-2023-2017

Server-side Template Injection SSTI in Shopware 6 = v6.4.20.0, v6.5.0.0-rc1 = v6.5.0.0-rc4, affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in...

CVE-2023-2017 Improper Control of Generation of Code in Twig Rendered Views in Shopware

Server-side Template Injection SSTI in Shopware 6 = v6.4.20.0, v6.5.0.0-rc1 = v6.5.0.0-rc4, affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in...

CVE-2023-2017 Improper Control of Generation of Code in Twig Rendered Views in Shopware

Server-side Template Injection SSTI in Shopware 6 = v6.4.20.0, v6.5.0.0-rc1 = v6.5.0.0-rc4, affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in...

CVE-2023-2017: Incomplete List of Disallowed Inputs

Server-side Template Injection SSTI in Shopware 6 = v6.4.20.0, v6.5.0.0-rc1 = v6.5.0.0-rc4, affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in...

CVE-2023-24607

Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3...

Code injection

Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3...

Exploit for Use After Free in Arm Bifrost_Gpu_Kernel_Driver

Exploit for CVE-2022-38181 for FireTV 2nd gen Cube This is a...

yespanya.com Cross Site Scripting vulnerability OBB-3252284

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ychcraft.com Cross Site Scripting vulnerability OBB-3252244

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

yazarperde.com Cross Site Scripting vulnerability OBB-3252226

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

neironix.io Cross Site Scripting vulnerability OBB-3252119

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...