436 matches found
CVE-2023-38021
CVE-2023-38021 relates to Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform prior to 3.32 for Intel SGX. A lack of pointer-alignment validation in enclave_ecall entry functions enables a local attacker to access unauthorized information via the system call layer. Impact is describe...
CVE-2023-38022: Undefined Security Weakness
An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager CCM Platform before 3.29 for Intel SGX. Insufficient pointer validation allows a local attacker to access unauthorized information. This relates to strlen and sgxiswithinuser...
CVE-2023-38022
Fortanix EnclaveOS CCM Platform (Intel SGX) before 3.29 is affected by insufficient pointer validation in the strlen/sgx_is_within_user logic, enabling a local attacker with low privileges to access unauthorized information. Impact: confidentiality only (high). Exploitation details not fully desc...
CVE-2023-48653
Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery CSRF via ccm/calendar/dialogs/event/delete/submit. An attacker can force an admin to delete events on the site because the event ID is numeric and sequential...
CVE-2023-48653: Cross-Site Request Forgery (CSRF)
Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery CSRF via ccm/calendar/dialogs/event/delete/submit. An attacker can force an admin to delete events on the site because the event ID is numeric and sequential...
CVE-2023-48651: Cross-Site Request Forgery (CSRF)
Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery CSRF at /ccm/system/dialogs/file/delete/1/submit...
CVE-2023-48652: Cross-Site Request Forgery (CSRF)
Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery CSRF via /ccm/system/dialogs/logs/deleteall/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated...
CVE-2023-48652
Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery CSRF via /ccm/system/dialogs/logs/deleteall/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated...
CVE-2023-48651
Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery CSRF at /ccm/system/dialogs/file/delete/1/submit...
cryptofuzz:cryptofuzz-boringssl-noasm: Heap-buffer-overflow in sm4_encrypt
Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6251750830768128 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl-noasm Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: Heap-buffer-overflow...
MAL-2023-8668 Malicious code in @saas-mf/ccm (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4491a282ac34d4b4d1727c2376452a4566fb2a48fc548c5a86ef03a62902d9d0 The OpenSSF Package Analysis project identified '@saas-mf/ccm' @ 25.0.9 npm as malicious. It is considered malicious because: - The package...
AZL-42751 CVE-2023-5363 affecting package cloud-hypervisor-cvm for versions less than 38.0.72.2-1
Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...
CVE-2023-5363
Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...
AZL-78558 CVE-2023-5363 affecting package openssl-fips-provider 3.1.2-2
Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...
Design/Logic Flaw
Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...
CVE-2023-5363 Incorrect cipher key & IV length processing
Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...
CVE-2023-5363
Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...
CVE-2023-5363
Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : PHP vulnerabilities (USN-4583-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4583-1 advisory. It was discovered that PHP incorrectly handled certain encrypt ciphers. An attacker could possibly use this issue to decrease...
PT-2023-7765
Name of the Vulnerable Software and Affected Versions Nagios XI affected versions not specified Description The issue is related to the missingobjects.php script in Nagios XI, which has insufficient access controls. This can be exploited by a remote attacker to modify CCM settings and clear the...