May 9, 2023—KB5026415 (Monthly Rollup)

May 9, 2023—KB5026415 Monthly Rollup Applies To Windows Server 2012 R2 Windows Embedded 8.1 Industry Enterprise Windows Embedded 8.1 Industry Pro Note REMINDERWindows 8.1 reached end of support on January 10, 2023, at which point technical assistance and software updates are no longer provided. I...

Important: edk2 security, bug fix, and enhancement update

EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fixes: openssl: X.400 address type confusion in X.509 GeneralName CVE-2023-0286 edk2: integer underflow in SmmEntryPoint function...

Cesanta MJS buffer error vulnerability

Cesanta MJS is an embedded JavaScript engine for C/C++ from Cesanta Ireland. It is designed for microcontrollers with limited resources. The main design goals are a small footprint and simple C/C++ interoperability. A security vulnerability exists in Cesanta MJS version v.1.26. An attacker has...

ALSA-2023:2165 Important: edk2 security, bug fix, and enhancement update

EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fixes: openssl: X.400 address type confusion in X.509 GeneralName CVE-2023-0286 edk2: integer underflow in SmmEntryPoint function...

PT-2025-40769

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel has a flaw related to the handling of nfsd file reference counts within the Network File System NFS copy codepath. Specifically, there is a potential for reference count...

Cross site scripting

A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting XSS in affected applications and sites built with Strikingly. The vulnerability exists because of Strikingly JavaScript library parsing the URL fragment allows access to the proto or...

CVE-2023-25289

Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1rtm.101119-1850 6.1.7601.1.0.65792 in embedded web server, allows attacker to gain sensitive information via a crafted GET request...

Valve: Steam Deck Single Click Root Remote Code Execution

Vulnerability description not provided...

CVE-2023-25289

Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1rtm.101119-1850 6.1.7601.1.0.65792 in embedded web server, allows attacker to gain sensitive information via a crafted GET request...

CVE-2023-25289

Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1rtm.101119-1850 6.1.7601.1.0.65792 in embedded web server, allows attacker to gain sensitive information via a crafted GET request...

PT-2023-20013 · Unknown · Virtualreception Digital Receptie

Name of the Vulnerable Software and Affected Versions: virtualreception Digital Receptie version win7sp1 rtm.101119-1850 6.1.7601.1.0.65792 Description: The issue allows an attacker to gain sensitive information via a crafted GET request to the embedded web server, exploiting a Directory Traversa...

CVE-2023-25289: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1rtm.101119-1850 6.1.7601.1.0.65792 in embedded web server, allows attacker to gain sensitive information via a crafted GET request...

EJS injection vulnerability

Github ejs is an embedded JavaScript template. An injection vulnerability exists in ejs version v3.1.9, which stems from vulnerability to server-side template injection SSTI attacks, which can be exploited by an attacker to achieve template injection through the configuration settings of the...

Code injection

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page...

PT-2023-20910 · Unknown · Obsidian Canvas

Name of the Vulnerable Software and Affected Versions: Obsidian Canvas version 1.1.9 Description: An issue in Obsidian Canvas allows remote attackers to send desktop notifications, record user audio, and potentially have other unspecified impacts. This can be achieved via an embedded website on t...

CVE-2023-27035

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page...

Obsidian security vulnerabilities

Obsidian is a knowledge base for native Markdown files from the Obsidian community. A security vulnerability exists in Obsidian Canvas version 1.1.9 that originates from a vulnerability that allows remote attackers to send desktop notifications, record user audio, and other unspecified impacts vi...

CVE-2023-27035: Incorrect Default Permissions

An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page...

protobuf-java: Message-Type Extensions parsing issue leads to DoS

A flaw was found in Message-Type Extensions in protobuf-java core that can lead to a denial of service. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields can cause objects to convert between mutable and immutable forms, resulting in long garbag...

WP Popups < 2.1.5.1 - Contributor+ Stored XSS

The plugin does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. This is due to an insufficie...