17610 matches found
CVE-2023-45364
An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestam...
Information disclosure
In jpg driver, there is a possible use after free due to a logic error. This could lead to remote information disclosure no additional execution privileges needed...
Out-of-bounds Read
libopensc.so is vulnerable to out-of-bounds reads. The vulnerability exists in card-myeid.c because it does not properly validate symmetric keys, which allows an attacker to send maliciously crafted responses to the APDU and read information outside of the intended range...
CVE-2023-45246
The CVE-2023-45246 issue affects Acronis products: Cyber Protect Cloud Agent (Linux/macOS/Windows) before build 36343 and Cyber Protect 16 before build 39169. It stems from missing/improper authentication, enabling sensitive information disclosure and manipulation (confidentiality and integrity i...
THE RETURN BOOLEAN VALUE OF THE excessivelySafeCall FUNCTION IS NOT CHECKED IN THE BranchBridgeAgent.lzReceive FUNCTION
Lines of code Vulnerability details Impact The BranchBridgeAgent.lzReceive function is used to send cross-chain messages using the layer zero messaging layer. The lzReceive function uses the excessivelySafeCall library on the same contract address addressthis to ensure the layer zero cross chain...
CVE-2023-44213
CVE-2023-44213 affects Acronis Cyber Protect Cloud Agent (Windows) before build 35739 and Acronis Cyber Protect 16 (Windows) before build 37391. Root cause: excessive collection of system information leading to sensitive information disclosure. Impact (as stated): disclosure of sensitive informat...
CVE-2023-2306
Qognify NiceVision versions 3.1 and earlier are affected by a vulnerability (CVE-2023-2306) that exposes sensitive information due to hard-coded credentials. With these credentials, an attacker could retrieve information about cameras, user data, and modify database records. The issue is document...
CVE-2023-44210
CVE-2023-44210 affects Acronis Agent on Linux, macOS, and Windows with builds before 29258 . The root cause is missing authorization, enabling sensitive information disclosure and manipulation . Public details in connected sources confirm vulnerable versions and the specific build to remediate. T...
CVE-2023-43804 `Cookie` HTTP header isn't stripped on cross-origin redirects
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...
CVE-2023-4211
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory...
CVE-2023-25989
creationtimestamp| type| source ---|---|--- 2023-10-03 16:41:11+00:00| seen| https://t.me/cibsecurity/71487...
CVE-2023-4886
CVE-2023-4886 affects Foreman (reported in Red Hat Satellite advisories). The issue is a world-readable Tomcat server.xml containing candlepin keystore/truststore passwords, enabling sensitive data exposure locally. Public references indicate Foreman is the affected component and list this CVE am...
CVE-2023-2544
Summary: CVE-2023-2544 is an authorization bypass vulnerability in UPV PEIX, specifically in the component pdf_curri_new.php. An authenticated user can exploit a POST request by altering the ID parameter to access other users’ stored information. Industry entries (NVD, CVE list, CNNVD, etc.) corr...
CVE-2023-2681
CVE-2023-2681 affects Jorani 1.0.0. An SQL Injection vulnerability exists in the /leaves/validate path via the id parameter, exploitable by an authenticated low-privilege user to extract arbitrary data. CVSS v3.1 base score 8.8 (High) with impact to confidentiality, integrity, and availability. T...
Insufficient Information
edge is vulnerable to insufficient Information.The vulnerability exists due to Insufficient policy enforcement in devetool . which allows to remote attacker to bypass navigation restrictions via a crafted HTML page...
CVE-2023-20819
CVE-2023-20819 affects MediaTek’s CDMA PPP protocol component, where a missing bounds check can enable an out-of-bounds write and remote escalation of privilege with no user interaction. A patch is identified as MOLY01068234 (Issue ALPS08010003); exploitation status is not provided in the availab...
PT-2023-28294 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: A tweet mentions a correction regarding a CVE number, suggesting that the correct identifier should be used. However, no details are provided...
PT-2023-32011 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. It appears to be a notification about a candidate number that is not in use...
CVE-2023-43726
CVE-2023-43726 affects OsCommerce (notably version 4.12.56860 per CVE listing). The vulnerability is a reflected XSS that allows an attacker to inject JavaScript via the parameter orders_products_status_manual_name_long[1], potentially resulting in unauthorized script execution in a user’s browse...