1065 matches found
CVE-2023-4801
An improper certification validation vulnerability in the Insider Threat Management ITM Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent has registered. All versions prior to...
CVE-2023-39962
Technical details for CVE-2023-39962 are not publicly available in the provided documents; monitor for updates from Nextcloud advisories.
CVE-2023-39961 Text does not respect "Allow download" permissions
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and...
CVE-2023-39959 Existence of calendars and address books can be checked by unauthenticated users
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for...
CVE-2023-39958 Missing brute force protection on password reset token OAuth2 API controller
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients...
CVE-2023-39958
CVE-2023-39958 affects Nextcloud Server where, in versions 22.0.0 through 22.2.x, 23.x, 24.x, 25.x, 26.x and 27.x, missing protection allowed brute-forcing of OAuth2 client secrets. The issue is mitigated by patches in Nextcloud Server: 25.0.9, 26.0.4, 27.0.1 and corresponding Enterprise Server p...
CVE-2023-39952
CVE-2023-39952 affects Nextcloud Server: a user could access files inside a subfolder of a groupfolder despite advanced permissions. Affected are Nextcloud Server versions starting at 22.0.0 up to but not including the patches listed for 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0....
New Microsoft Security innovations expand multicloud visibility and enhance multiplatform protection
With more than 90 percent of organizations adopting a multicloud strategy1 and cloud-based cyberattacks growing 48 percent year over year,2 securing multicloud and hybrid environments is more important than ever. To successfully protect multicloud infrastructure—where customers are utilizing two ...
Microsoft Azure Security Vulnerabilities
Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Azure HDInsights. An attacker exploited the vulnerability to perform spoofing attacks...
Qualys Expands Cloud Platform for First-Party Application Risk Detection and Remediation
Have you faced the need to identify & respond to open-source package vulnerabilities like log4shell, openSSL, etc, in production from Day Zero? Are you using first-party, homegrown applications and are worried the risk introduced by those applications is not seen or addressed? Qualys new...
The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar, related to authentication deficiencies, allows attackers to gain access to the configuration of the cloud-based platform.
The vulnerability of the cloud-based messaging and streaming communication platform Apache Pulsar is related to deficiencies in authentication mechanisms. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the configuration of the cloud-based platfo...
The vulnerability of the application programming interface of the cloud platform for developing and deploying applications. VMware Tanzu Application Service for VMs (TAS for VMs) and the Isolation Segment management platform allow a malicious actor to gain unauthorized access to protected information.
The vulnerability of the application programming interface of a cloud platform for developing and deploying VMware Tanzu Application Service for VMs TAS for VMs and isolation segment management platform is related to the disclosure of administrator registration data in system audit logs during...
TeamTNT's Cloud Credential Stealing Campaign Now Targets Azure and Google Cloud
A malicious actor has been linked to a cloud credential stealing campaign in June 2023 that's focused on Azure and Google Cloud Platform GCP services, marking the adversary's expansion in targeting beyond Amazon Web Services AWS. The findings come from SentinelOne and Permiso, which said the...
USN-6228-1: Linux kernel vulnerabilities
It was discovered that the XFS file system implementation in the Linux kernel did not properly perform metadata validation when mounting certain images. An attacker could use this to specially craft a file system image that, when mounted, could cause a denial of service system crash. CVE-2023-212...
USN-6220-1: Linux kernel vulnerabilities
Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-35788, LP: 2023577 It was discovered that for some...
Unauthorized Access Vulnerability in SRM Cloud Platform of Shanghai Zhenyun Information Technology Co.
Shanghai Zhenyun Information Technology Co., Ltd. is a domestic procurement digital management platform provider. An unauthorized access vulnerability exists in the SRM cloud platform of Shanghai Zhenyun Information Technology Co., Ltd, which can be exploited by attackers to obtain sensitive...
The vulnerability of the cloud platform for protecting applications from unauthorized users and Cisco Duo devices for Mac OS allows a intruder to bypass the authentication process and gain unauthorized access to the device.
The vulnerability of the cloud platform for protecting applications from unauthorized users and Cisco Duo devices for Mac OS is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a hacker to gain unauthorized access to the device...
CVE-2023-34735
Property Cloud Platform Management Center 1.0 is vulnerable to error-based SQL injection...
