CVE-2023-46354

The CVE-2023-46354 entry concerns PrestaShop’s Orders (CSV, Excel) Export PRO module (ordersexport)

CVE-2023-46751

CVE-2023-46751 affects Ghostscript; the issue is a dangling pointer in gdev_prn_open_printer_seekable() that could crash the application when processing malformed documents. The vulnerability is remotely triggerable and has been addressed in various advisories. Public details corroborate that Gho...

Generative AI Security: Preventing Microsoft Copilot Data Exposure

Microsoft Copilot has been called one of the most powerful productivity tools on the planet. Copilot is an AI assistant that lives inside each of your Microsoft 365 apps — Word, Excel, PowerPoint, Teams, Outlook, and so on. Microsoft's dream is to take the drudgery out of daily work and let human...

OSINT. What can you find from a domain or company name

We carry out lots of attack surface assessments, parts of which involve investigating information that has been unintentionally disclosed. To help OPSEC people I thought it might be useful to go over some of the key things that can be found using domain and company names. Domain name So let’s div...

CVE-2023-44295

Dell PowerScale OneFS versions 8.2.2.x–9.6.0.x are affected by an improper resource control during the resource’s lifetime, enabling a low-privilege attacker to potentially cause information loss and disclosure. The available sources identify the vulnerability and affected product family but do n...

CVE-2023-43472

MLFlow before 2.8.1 is affected by CVE-2023-43472. A remote attacker can disclose sensitive information via a crafted request to the MLFlow REST API. Impact described in sources: access to sensitive information stored in MLFlow. Root cause: issue exists in MLFlow 2.8.1 and earlier as stated in th...

CVE-2023-40098

The CVE-2023-40098 issue affects Android and stems from a logic error in mOnDone() within NotificationConversationInfo.java, enabling local information disclosure of another user’s app notification data. Exploitation requires local access with no user interaction specified, and the confidentialit...

CVE-2023-45773

The CVE-2023-45773 issue affects the Bluetooth stack component (btm_ble_gap.cc) in Android. It describes an out-of-bounds write caused by a missing bounds check in multiple functions, which could enable local escalation of privilege with User privileges required and no user interaction. The threa...

CVE-2023-40092

CVE-2023-40092 affects the Android Framework, specifically the verifyShortcutInfoPackage function in ShortcutService.java. The Red Hat/Android/NVD entries describe a confused deputy scenario that could allow an authenticated local attacker to view another user’s image, causing local information d...

CVE-2023-40073

CVE-2023-40073 concerns an information disclosure in Android’s framework: in the method visitUris of Notification.java, there is a cross-user media read (Confused Deputy) that can lead to local information disclosure without extra execution privileges. The exposed data is restricted to local acce...

CVE-2023-40076

The CVE-2023-40076 issue concerns Android’s CredentialManagerUi.java: in createPendingIntent, a permissions bypass could allow access to credentials from other users. This represents a local elevation of privilege, with exploitation possible without additional execution privileges or user interac...

CVE-2023-21166

CVE-2023-21166: Use-after-free in RGXBackingZSBuffer (rgxta3d.c) of the PowerVR GPU driver can enable arbitrary code execution and local kernel privilege escalation without extra user interaction. Public details across the connected entries confirm the issue and its impact (no explicit exploit sp...

Design/Logic Flaw

IBM Planning Analytics on Cloud Pak for Data 4.0 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication. IBM X-Force ID: 247898...

ASB-A-299146326

Bulletin has no description...

CVE-2023-2265

The CVE-2023-2265 vulnerability affects Schweitzer Engineering Laboratories SEL-411L. Affected revisions span multiple firmware lines (R118 through R129 with various V0–V5 ranges). The issue is an improper restriction of rendered UI layers or frames, which could allow an unauthenticated attacker ...

CVE-2023-25057

CVE-2023-25057 affects the WordPress plugin Libsyn Publisher Hub (Libsyn Podcasting) up to version 1.3.2. The vulnerability is described as Exposure of Sensitive Information to an Unauthorized Actor, with an impact score of 5.3 (Medium) and CVSS:3.1/3.1 metrics indicating unauthenticated access o...

CVE-2023-26533

CVE-2023-26533 affects the Zippy WordPress plugin by Gesundheit Bewegt GmbH, up to version 1.6.1. The vulnerability exposes sensitive information to unauthorized actors due to information disclosure. A fix is available in version 1.6.2. CVSS v3.1 base score is 6.5 (Medium), with network attack ve...

CVE-2023-37868

CVE-2023-37868 concerns WordPress Premium Addons PRO (Leap13 Premium Addons PRO). Affected: Premium Addons PRO versions up to and including 2.9.0. Description: Exposure of sensitive information to an unauthorized actor. Root cause/source indicates information disclosure vulnerability in the plugi...

CVE-2023-40211

CVE-2023-40211 affects PickPlugins Post Grid Combo – 36+ Gutenberg Blocks (WordPress Post Grid) with versions up to 2.2.50. The vulnerability is an information exposure allowing unauthenticated access, as detailed in PatchStack and Nuclei templates (POST/REST paths likely expose sensitive data to...

CVE-2023-40662

CVE-2023-40662 affects the WordPress plugin Cookies and Content Security Policy (<= 2.15). The vulnerability exposes sensitive information to an unauthorized actor due to a data-exposure flaw in the plugin, as documented by multiple sources (NVD, Red Hat RH:CVE, CVE List, Patchstack). The CVSS...