PT-2023-17908 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-11 through Android-13 Description: A logic error in the code of InstallPackageHelper.java, specifically in the verifyReplacingVersionCode function, allows for a possible downgrade of system apps below the system image...

CVE-2023-21116

In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for...

Microsoft Office Microsoft 365 Apps for Enterprise DoS

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise programs exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to perform service denial-of-service attacks...

Microsoft Office Code Execution

The vulnerability of Microsoft Excel, Microsoft Office, Microsoft 365 Apps for Enterprise, Microsoft SharePoint, and Microsoft Office Online Server relates to the execution of operations outside of the buffer in memory. Exploitation of this vulnerability can allow an attacker to execute arbitrary...

App-V Privilege Escalation Command Execution

The vulnerability of the App-V software service for virtualizing and delivering Citrix Virtual Apps and Desktops formerly XenApp and XenDesktop on Windows operating systems is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiti...

Operation ChattyGoblin: Hackers Targeting Gambling Firms via Chat Apps

A gambling company in the Philippines was the target of a China-aligned threat actor as part of a campaign that has been ongoing since October 2021. Slovak cybersecurity firm ESET is tracking the series of attacks against Southeast Asian gambling companies under the name Operation ChattyGoblin...

May 9, 2023—KB5026368 (OS Build 22000.1936)

None None...

May 9, 2023—KB5026372 (OS Build 22621.1702)

None None...

Security Updates for Microsoft Office Online Server (May 2023)

The Microsoft Office Web Apps installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

CVE-2023-22813 Device API endpoint missing access controls on Western Digital Mobile and Web Apps

A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS...

CVE-2023-22813

The CVE-2023-22813 entry describes a vulnerability in Western Digital My Cloud OS 5 and related apps (My Cloud OS 5 Mobile/Web, My Cloud Home Mobile/Web, ibi Mobile/Web, SanDisk ibi) where a device API endpoint lacks access controls due to a permissive CORS policy and no authentication for privat...

CVE-2023-22813 Device API endpoint missing access controls on Western Digital Mobile and Web Apps

A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS...

CVE-2022-47439

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Rocket Apps Open Graphite plugin = 1.6.0 versions...

CVE-2022-47439

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Rocket Apps Open Graphite plugin = 1.6.0 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Rocket Apps Open Graphite plugin = 1.6.0 versions...

CVE-2022-47439 WordPress Open Graphite Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Rocket Apps Open Graphite plugin = 1.6.0 versions...

CVE-2022-47439

CVE-2022-47439 affects WordPress plugin Open Graphite (Rocket Apps)

CVE-2022-47439: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Rocket Apps Open Graphite plugin = 1.6.0 versions...

CVE-2023-27945

CVE-2023-27945 affects macOS and Xcode components where entitlements were improved to fix a privacy issue: a sandboxed app may be able to collect system logs due to entitlements handling. Affected products/versions listed in connected docs include Xcode 14.3, macOS Big Sur 11.7.7, and macOS Monte...

PT-2023-15315 · Rocket Apps · Rocket Apps Open Graphite Plugin

Name of the Vulnerable Software and Affected Versions: Rocket Apps Open Graphite plugin versions = 1.6.0 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...