PT-2023-4469 · D Link · D-Link Dir-880L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-880 A1 FW107WWb08 Description: The issue is related to a buffer overflow in the function FUN 0001be68 of the D-Link DIR-880 A1 router's firmware. This buffer overflow can be exploited by a remote attacker to execute arbitrary code...

CVE-2023-38409 affecting package kernel 5.10.185.1-1

CVE-2023-38409 affecting package kernel 5.10.185.1-1. A patched version of the package is available...

Juniper Junos OS Vulnerability (JSA71647)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA71647 advisory. - A Reachable Assertion vulnerability in Routing Protocol Daemon RPD of Juniper Networks Junos OS and Junos OS Evolved allows a locally-based, low-privileged attacker to cau...

GHSA-9PHH-R37V-34WH lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files

Impact The browser renders the resulting HTML when opening a direct link to an HTML file via lakeFS. Any JavaScript within that page is executed within the context of the domain lakeFS is running in. An attacker can inject a malicious script inline, download resources from another domain, or make...

SUSE CVE-2023-39958

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients...

DEBIAN-CVE-2023-39534

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS. Version 2.10.0, 2.9.2, and 2.6.5 contain a patch for this iss...

CVE-2023-39945

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a data submessage sent to PDP port raises unhandled BadParamException in fastcdr, which in turn crashes fastdds. Versions 2.11.0,...

UBUNTU-CVE-2023-39946

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, heap can be overflowed by providing a PIDPROPERTYLIST parameter that contains a CDR string with length larger than the size of...

Information disclosure

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a data submessage sent to PDP port raises unhandled BadParamException in fastcdr, which in turn crashes fastdds. Versions 2.11.0,...

CVE-2023-39947 Another heap overflow in push_back_helper

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, even after the fix at commit 3492270, malformed PIDPROPERTYLIST parameters cause heap overflow at a different program counter. Th...

PT-2023-11769 · Unknown · Kindeditor

Name of the Vulnerable Software and Affected Versions: kindeditor version 4.1.12 Description: The issue is related to a Cross Site Scripting XSS vulnerability in the content1 parameter in demo.jsp of kindeditor. This allows attackers to execute arbitrary code. Recommendations: For kindeditor...

Design/Logic Flaw

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using ERC2771Context along with a custom trusted forwarder may see msgSender return address0 in calls that originate from the forwarder with calldata shorter...

CVE-2023-39963 Missing password confirmation when creating app passwords

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully steali...

CVE-2023-39962

Technical details for CVE-2023-39962 are not publicly available in the provided documents; monitor for updates from Nextcloud advisories.

CVE-2023-39961 Text does not respect "Allow download" permissions

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and...

CVE-2023-39959 Existence of calendars and address books can be checked by unauthenticated users

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for...

CVE-2023-39959

CVE-2023-39959 affects Nextcloud Server. Unauthenticated users could send a DAV request to determine whether a calendar or address book with a given identifier exists on victims’ accounts. Affected are Nextcloud Server versions prior to 25.0.9, 26.0.4, and 27.0.1 (and corresponding Enterprise Ser...

CVE-2023-39959 Existence of calendars and address books can be checked by unauthenticated users

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for...

CVE-2023-39958

CVE-2023-39958 affects Nextcloud Server where, in versions 22.0.0 through 22.2.x, 23.x, 24.x, 25.x, 26.x and 27.x, missing protection allowed brute-forcing of OAuth2 client secrets. The issue is mitigated by patches in Nextcloud Server: 25.0.9, 26.0.4, 27.0.1 and corresponding Enterprise Server p...

CVE-2023-39958 Missing brute force protection on password reset token OAuth2 API controller

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients...