17608 matches found
CVE-2023-21304
CVE-2023-21304 describes an information-disclosure flaw in Android’s Content Service that can reveal whether an app is installed without query permissions, via a side-channel. The issue allows local information leakage without extra execution privileges and does not require user interaction to ex...
Inkdrop vulnerable to code injection
Overview Inkdrop provided by Takuya Matsuyama is a Markdown editor. Inkdrop contains a code injection vulnerability CWE-94. T.Nodoka reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a specially crafted...
ROS-20231030-03
Vulnerability in lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c files. zchunk is related to integer overflow . Exploitation of the vulnerability could allow an attacker acting locally to gain unauthorized access to protected information...
CVE-2023-46215
CVE-2023-46215 affects Apache Airflow and its Celery provider. The issue is that sensitive information is logged in clear text when using rediss, amqp, or rpc protocols as the Celery result backend. Affected versions: Airflow Celery provider 3.3.0–3.4.0 and Apache Airflow 1.10.0–2.6.3. Impact is ...
CVE-2023-46569
An out-of-bounds read in radare2 v.5.8.9 and before exists in the printinsn32fpu function of libr/arch/p/nds32/nds32-dis.h...
CVE-2023-27854
creationtimestamp| type| source ---|---|--- 2023-10-27 22:17:18+00:00| seen| https://t.me/cibsecurity/73071...
CVE-2023-40134
CVE-2023-40134 concerns a local information disclosure in the Android UI code path. The vulnerability is described as a confused deputy in isFullScreen/FillUi.java that can allow viewing another user’s images without extra execution privileges and without user interaction. Public sources in the c...
Arsenal - Just A Quick Inventory And Launcher For Hacking Programs
Arsenal is just a quick inventory, reminder and launcher for pentest commands. This project written by pentesters for pentesters simplify the use of all the hard-to-remember commands In arsenal you can search for a command, select one and it's prefilled directly in your terminal. This functionali...
CVE-2023-46604
creationtimestamp| type| source ---|---|--- 2023-10-27 18:17:07+00:00| seen| https://t.me/cibsecurity/73057 2023-11-01 20:42:27+00:00| seen| MISP/f9c19fe0-d99a-4345-8423-5635b5d8bf1f 2023-11-02 05:37:58+00:00| exploited| https://t.me/thehackernews/4088 2023-11-02 06:01:02+00:00|...
GHSA-HMQJ-GV2M-HQ55 baserCMS Directory Traversal vulnerability in Form submission data management Feature
There is a Directory Traversal Vulnerability in Form submission data management Feature to baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible...
discjockey-agentur.de Improper Access Control vulnerability OBB-3766147
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-31422
Elastic Kibana 8.10.0 is affected when logging in JSON layout or with %meta in a pattern layout, potentially writing sensitive data to logs (credentials, headers, query params, etc.). Upgrading to Kibana 8.10.1 resolves the issue; Elastic also provides mitigations and guidance for self-managed an...
PT-2023-6586 · Sielco · Sielco Polyeco1000
Name of the Vulnerable Software and Affected Versions: Sielco PolyEco1000 affected versions not specified Description: The issue is related to incorrect session management. It may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The...
CVE-2023-46668
CVE-2023-46668 affects Elastic Endpoint versions 7.9.0 through 8.10.3. When Endpoint is configured with a non-default option that enables debug logging and Elastic Agent is also configured to collect and ship those logs to Elasticsearch, API keys used by Elastic Agent can be viewed in Elasticsear...
CVE-2023-46542
creationtimestamp| type| source ---|---|--- 2023-10-25 22:52:35+00:00| seen| https://t.me/cibsecurity/72884...
CVE-2023-27257
CVE-2023-27257 affects IDAttend’s IDWeb application (versions 3.1.052 and earlier). The underlying issue is missing authentication in the GetActiveToiletPasses method, allowing unauthenticated attackers to retrieve student information via the affected endpoint (attack vector: network; impact: con...
The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...
Pimcore User Enumeration
Pimcore versions before 10.1.3 suffer from an user enumeration vulnerability through the administration panel lost password feature. By submitting multiple usernames, a remote and unauthenticated attacker can infer the valid administrative accounts on the target Pimcore instance. No source data...
CVE-2023-38845
CVE-2023-38845 affects Anglaise.Company version 13.6.1. Multiple connected documents confirm an issue where a remote attacker can obtain sensitive information through a crafted GET request. The exact root cause, vulnerable component, and impact details are not fully elaborated in the provided sou...