PT-2023-11769 · Unknown · Kindeditor

Name of the Vulnerable Software and Affected Versions: kindeditor version 4.1.12 Description: The issue is related to a Cross Site Scripting XSS vulnerability in the content1 parameter in demo.jsp of kindeditor. This allows attackers to execute arbitrary code. Recommendations: For kindeditor...

Design/Logic Flaw

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0 in calls that originate from the forwarder with calldata shorter...

CVE-2023-39963 Missing password confirmation when creating app passwords

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully steali...

CVE-2023-39962

Technical details for CVE-2023-39962 are not publicly available in the provided documents; monitor for updates from Nextcloud advisories.

CVE-2023-39961 Text does not respect "Allow download" permissions

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and...

CVE-2023-39959

CVE-2023-39959 affects Nextcloud Server. Unauthenticated users could send a DAV request to determine whether a calendar or address book with a given identifier exists on victims’ accounts. Affected are Nextcloud Server versions prior to 25.0.9, 26.0.4, and 27.0.1 (and corresponding Enterprise Ser...

CVE-2023-39959 Existence of calendars and address books can be checked by unauthenticated users

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for...

CVE-2023-39959 Existence of calendars and address books can be checked by unauthenticated users

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for...

CVE-2023-39958

CVE-2023-39958 affects Nextcloud Server where, in versions 22.0.0 through 22.2.x, 23.x, 24.x, 25.x, 26.x and 27.x, missing protection allowed brute-forcing of OAuth2 client secrets. The issue is mitigated by patches in Nextcloud Server: 25.0.9, 26.0.4, 27.0.1 and corresponding Enterprise Server p...

CVE-2023-39958 Missing brute force protection on password reset token OAuth2 API controller

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients...

CVE-2023-38428 affecting package kernel for versions less than 5.15.122.1-2

CVE-2023-38428 affecting package kernel for versions less than 5.15.122.1-2. A patched version of the package is available...

CVE-2023-23003 affecting package kernel for versions less than 5.15.118.1-2

CVE-2023-23003 affecting package kernel for versions less than 5.15.118.1-2. A patched version of the package is available...

CVE-2023-35826 affecting package kernel for versions less than 5.15.122.1-2

CVE-2023-35826 affecting package kernel for versions less than 5.15.122.1-2. A patched version of the package is available...

CVE-2022-45919 affecting package kernel for versions less than 5.15.122.1-2

CVE-2022-45919 affecting package kernel for versions less than 5.15.122.1-2. A patched version of the package is available...

CVE-2023-33285 affecting package qt5-qtbase for versions less than 5.12.11-9

CVE-2023-33285 affecting package qt5-qtbase for versions less than 5.12.11-9. A patched version of the package is available...

Design/Logic Flaw

Notes is a note-taking app for Nextcloud, an open-source cloud platform. Starting in version 4.4.0 and prior to version 4.8.0, when creating a note file with HTML, the content is rendered in the preview instead of the file being offered to download. Nextcloud Notes app version 4.8.0 contains a...

Code injection

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a user can access files inside a subfolder of a groupfolder accessible to them, even if advanced...

Code injection

useroidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also...

libxml2 security update

2.9.7-16.1 - Fix CVE-2023-28484 2185994 - Fix CVE-2023-29469 2185984...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the...