CVE-2023-39954

CVE-2023-39954 affects the Nextcloud user_oidc app (OIDC backend). Versions 1.0.0 through 1.3.2 allow an attacker with read access to a database snapshot to impersonate the Nextcloud server toward linked servers due to unencrypted storage of the client secret. A patch exists in version 1.3.3 . No...

CVE-2023-39953

The CVE-2023-39953 entry concerns Nextcloud’s user_oidc app. Affected versions: 1.0.0 through 1.3.2. Root cause: missing verification of the issuer in the OIDC token validation, enabling a potential Man-in-the-Middle attack that could return corrupted or known tokens. Impact: attacker could lever...

CVE-2023-39953 Issuer not verified from obtained token in user_oidc

useroidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also...

CVE-2022-44629

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin = 2.0.0 versions...

CVE-2022-44629

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin = 2.0.0 versions...

CVE-2022-44629 WordPress Catalyst Connect Zoho CRM Client Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin = 2.0.0 versions...

CVE-2022-44629

CVE-2022-44629 affects the WordPress plugin Catalyst Connect Zoho CRM Client Portal (

PT-2023-27170 · Nextcloud · Nextcloud +1

Name of the Vulnerable Software and Affected Versions: user oidc versions 1.0.0 through 1.3.2 Description: The issue is related to the missing verification of the issuer in the user oidc module for Nextcloud, allowing an attacker to perform a man-in-the-middle attack by returning corrupted or kno...

WordPress Plugin Catalyst Connect Catalyst Connect Zoho CRM Client Portal Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-33468

KramerAV VIA Connect 2 and VIA Go 2 devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the physical scree...

CVE-2023-33468

KramerAV VIA Connect 2 and VIA Go 2 devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the physical scree...

CVE-2023-33469

In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect 2 and VIA Go 2 devices with a version prior to 4.0.1.1326 can be exploited to achieve local code execution at the root level...

CVE-2023-33468

KramerAV VIA Connect 2 and VIA Go 2 devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the physical scree...

CVE-2023-33469

In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect 2 and VIA Go 2 devices with a version prior to 4.0.1.1326 can be exploited to achieve local code execution at the root level...

Design/Logic Flaw

KramerAV VIA Connect 2 and VIA Go 2 devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the physical scree...

Security Bulletin: IBM App Connect Enterprise toolkit and IBM Integration Bus toolkit are vulnerable to a local authenticated attacker and a denial of service due to Guava and JDOM (CVE-2023-2976, CVE-2021-33813).

Summary IBM App Connect Enterprise toolkit and IBM Integration Bus toolkit are vulnerable to a local authenticated attacker and a denial of service due to Guava and JDOM CVE-2023-2976, CVE-2021-33813. The resolving fixes include Guava version =32.1.1 & JDOM version =2.0.6.1 Vulnerability Details...

PT-2023-24349 · Kramerav · Kramerav Via Connect +1

Name of the Vulnerable Software and Affected Versions: KramerAV VIA Connect 2 and VIA Go 2 versions prior to 4.0.1.1326 Description: The issue allows for remote manipulation of the device by extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the...

CVE-2023-33468

The CVE affects KramerAV VIA Connect (2) and VIA Go (2) prior to version 4.0.1.1326. The root cause is a remote-exploitable flow that lets an attacker obtain the connection confirmation code without using the physical screen, enabling remote manipulation of the device. Affected versions include 4...

PT-2023-24350 · Kramerav · Kramerav Via Connect +1

Name of the Vulnerable Software and Affected Versions: KramerAV VIA Connect 2 versions prior to 4.0.1.1326 KramerAV VIA Go 2 versions prior to 4.0.1.1326 Description: The issue allows for local code execution at the root level when the screen is visible and remote mouse connection is enabled. Thi...

CVE-2023-33469

In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect 2 and VIA Go 2 devices with a version prior to 4.0.1.1326 can be exploited to achieve local code execution at the root level...