DEBIAN-CVE-2023-1230

Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-1230

Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-1230

CVE-2023-1230 concerns an Inappropriate implementation in WebApp Installs in Google Chrome on Android before version 111.0.5563.64. The issue allows an attacker who persuades a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. Affected product ...

CVE-2023-1230

Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-1230

Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. Chromium security severity: Medium...

Security Bulletin: IBM Observability with Instana (OnPrem) affected by OpenSSL vulnerabilities.

Summary IBM Observability with Instana OnPrem has addressed the following OpenSSL vulnerabilities in it's self-hosted Docker-based installer: CVE-2022-3602 and CVE-2022-3786. Vulnerability Details CVEID:CVE-2022-3602 DESCRIPTION: OpenSSL is vulnerable to a stack-based buffer overflow, caused by...

CVE-2023-25143: Uncontrolled Search Path Element

An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote code execution state on affected products...

CVE-2023-1230: Undefined Security Weakness

Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. Chromium security severity: Medium...

PT-2023-19936

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One Server affected versions not specified Description An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote code execution state on affected...

Google Chrome security vulnerabilities

Google Chrome is a web browser from the American company Google Google. A security vulnerability exists in versions prior to Google Chrome on Android 111.0.5563.64. The vulnerability is exploited by attackers to convince users to install a malicious WebApp, which spoofs the contents of the PWA...

CVE-2023-23939 Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower

Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This...

CVE-2023-23939

CVE-2023-23939 concerns the Azure/setup-kubectl GitHub Action (Kubectl installer). Affected versions prior to 3.0 suffer from insecure temporary file creation that makes the Kubectl binary world-writable, allowing any local actor on the Actions runner to replace it. The installer uses fs.chmodSyn...

setup.php script Unauthenticated Access

The vulnerability in the setup.php script of the software for managing medical organizations like OpenEMR relates to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Windows Installer Privilege Escalation

The vulnerability of Windows operating system installers exists due to insufficient checks on input data. Exploiting this vulnerability can allow attackers to increase their privileges...

PT-2023-9632 · Qemu · Qemu Guest Agent

Name of the Vulnerable Software and Affected Versions: QEMU Guest Agent affected versions not specified Description: A flaw was found in the QEMU Guest Agent service for Windows, allowing a local unprivileged user to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to...

USN-5821-4 python-pip regression

USN-5821-3 fixed a vulnerability in pip. The update introduced a minor regression in Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Sebastian Chnelik discovered that wheel incorrectly handled...

PUB-A-236687884

In InstallStart of InstallStart.java, there is a possible way to change the installer package name due to an improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

USN-5821-3: pip regression

USN-5821-1 fixed a vulnerability in wheel and pip. Unfortunately, it was missing a commit to fix it properly in pip. We apologize for the inconvenience. Original advisory details: Sebastian Chnelik discovered that wheel incorrectly handled certain file names when validated against a regex...

SUSE CVE-2023-0664

A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system...

K41272944: Intel MPSS vulnerability CVE-2020-0563

Security Advisory Description Improper permissions in the installer for IntelR MPSS before version 3.8.6 may allow an authenticated user to potentially enable escalation of privilege via local access. CVE-2020-0563 Impact There is no impact; F5 products are not affected by this vulnerability...