CVE-2023-48247

Summary: CVE-2023-48247 describes an unauthenticated remote exploit that allows reading arbitrary files under the application’s OS user (root) context via a crafted HTTP request. The vulnerability is documented across multiple feeds (NVD, Red Hat, CVE List) with a CVSSv3.1 base score of 7.5 (HIGH...

CVE-2023-48246

The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...

CVE-2023-48246

CVE-2023-48246 affects Bosch Nexo/Nexo-OS devices. A crafted HTTP request can trigger downloading arbitrary files from all system paths under the application’s OS user context (root). Documented impact is file disclosure with root privileges; no exploitation details or likelihood provided. Public...

CVE-2023-48246

The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...

CVE-2023-48245

The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user “root” via a crafted HTTP request...

CVE-2023-48245

The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user “root” via a crafted HTTP request...

CVE-2023-48245

CVE-2023-48245 affects Bosch Nexo OS (and related Bosch Nexo products) where an unauthenticated remote attacker can upload arbitrary files in the application OS user context (root) via a crafted HTTP request. The connected sources corroborate the vulnerability exists in the Nexo/OS environment an...

CVE-2023-48244

The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request...

CVE-2023-48244

CVE-2023-48244 describes a vulnerability that allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request. The documents do not publicly specify affected products, versions, or the exact component/file, nor a confirm...

CVE-2023-48244

The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request...

CVE-2023-48243

The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution RCE with root privileges on the device...

CVE-2023-48242

The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...

CVE-2023-48242

CVE-2023-48242 is described across multiple feeds as an authenticated remote vulnerability where an attacker can download arbitrary files from all paths under the application OS user (root) via a crafted HTTP request. The provided documents do not specify affected products, versions, or concrete ...

CVE-2023-48242

The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...

Remote Code Execution

Microsoft.IdentityModel.Protocols.SignedHttpRequest is vulnerable to Remote Code Execution. The vulnerability is caused due to Microsoft.IdentityModel trusting the jku claim by default for the SignedHttpRequest protocol. An attacker can make any remote or local HTTP GET request as a result of thi...

WWBN AVideo salt generation insufficient entropy vulnerability

Talos Vulnerability Report TALOS-2023-1900 WWBN AVideo salt generation insufficient entropy vulnerability January 10, 2024 CVE Number CVE-2023-49599 SUMMARY An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially...

WWBN AVideo aVideoEncoder.json.php chunkFile path information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1869 WWBN AVideo aVideoEncoder.json.php chunkFile path information disclosure vulnerability January 10, 2024 CVE Number CVE-2023-47171 SUMMARY An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN...

Ubuntu: Security Advisory (USN-6038-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WWBN AVideo getLanguageFromBrowser local file inclusion vulnerability

Talos Vulnerability Report TALOS-2023-1886 WWBN AVideo getLanguageFromBrowser local file inclusion vulnerability January 10, 2024 CVE Number CVE-2023-47862 SUMMARY A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. ...

WWBN AVideo image404Raw.php information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1881 WWBN AVideo image404Raw.php information disclosure vulnerability January 10, 2024 CVE Number CVE-2023-49738 SUMMARY An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A special...