PT-2023-21493 · Dell · Dell Bios

Name of the Vulnerable Software and Affected Versions: Dell BIOS affected versions not specified Description: The issue is related to an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability to modify...

Dell BIOS input validation error vulnerability

Dell BIOS is embedded software on a small memory chip on a computer motherboard from Dell USA. Dell BIOS has an input validation error vulnerability that stems from incorrect input validation. An attacker could exploit this vulnerability to modify UEFI variables...

Dell BIOS input validation error vulnerability

Dell BIOS is embedded software on a small memory chip on a computer motherboard from Dell USA. Dell BIOS has an input validation error vulnerability that stems from incorrect input validation. An attacker could exploit this vulnerability to modify UEFI variables...

Shescape potential environment variable exposure on Windows with CMD

Impact This impact users of Shescape: 1. On Windows using the Windows Command Prompt i.e. cmd.exe, and 2. Using quote/quoteAll or escape/escapeAll with the interpolation option set to true. An attacker may be able to get read-only access to environment variables. Example: javascript import as cp...

GHSA-3G7P-8QHX-MC8R Shescape potential environment variable exposure on Windows with CMD

Impact This impact users of Shescape: 1. On Windows using the Windows Command Prompt i.e. cmd.exe, and 2. Using quote/quoteAll or escape/escapeAll with the interpolation option set to true. An attacker may be able to get read-only access to environment variables. Example: javascript import as cp...

PT-2023-25389 · Shescape · Shescape

Name of the Vulnerable Software and Affected Versions: Shescape versions prior to 1.7.1 Description: An attacker may be able to get read-only access to environment variables. This issue affects users of Shescape on Windows using the Windows Command Prompt, and when using quote/quoteAll or...

CVE-2023-29545

Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are...

UBUNTU-CVE-2023-29545

Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are...

CVE-2023-29545

Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are...

CVE-2023-29545: Undefined Security Weakness

Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are...

New Supply Chain Attack Exploits Abandoned S3 Buckets to Distribute Malicious Binaries

In what's a new kind of software supply chain attack aimed at open source projects, it has emerged that threat actors could seize control of expired Amazon S3 buckets to serve rogue binaries without altering the modules themselves. "Malicious binaries steal the user IDs, passwords, local machine...

THERE IS NO INPUT VALIDATION FOR CRITICAL STATE VARIABLES WHICH COULD BREAK THE CORE FUNCTIONALITY OF THE PROTOCOL

Lines of code Vulnerability details Impact In the LlamaAbsoluteStrategyBase.queuingPeriod variable denotes the minimum time in seconds between queueing and execution of action. The LlamaAbsoluteStrategyBase.minExecutionTime returns the block.timestamp + queuingPeriod timestamp. Here queuingPeriod...

CVE-2023-34108 Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords

mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using specially crafted...

K000134945: Spring Boot vulnerability CVE-2022-46166

Security Advisory Description Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers e.g. Teams-Notifier and write access to environment variables via UI are affected. User...

CVE-2023-28163

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerabilit...

UBUNTU-CVE-2023-28163

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerabilit...

Information Disclosure

toui is vulnerable to Information Disclosure. The vulnerability exists because Website.uservars are available to all users via server side caching, which leads user-specific variables to being shared between users...

CVE-2023-28163

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerabilit...

Information disclosure

gptacademic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gptacademic 3.37 and prior. This issue affects some unknown processing of the component Configuration File Handler. The manipulation of the argument file leads to information disclosure. Since no sensitive...

CVE-2023-33979 gpt_academic's Configuration File vulnerable to File Information Disclosure

gptacademic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gptacademic 3.37 and prior. This issue affects some unknown processing of the component Configuration File Handler. The manipulation of the argument file leads to information disclosure. Since no sensitive...