17610 matches found
CVE-2023-39195
Rejected reason: CVE-2023-39195 was found to be a duplicate of CVE-2023-42755. Please see https://access.redhat.com/security/cve/CVE-2023-42755 for more information...
CVE-2023-44273
CVE-2023-44273 (gnark-crypto) affects github.com/consensys/gnark-crypto up to v0.11.2. During ECDSA/EdDSA signature deserialization, the library does not enforce that values lie in the range [1, n−1], enabling signature malleability and potential DoS. The issue has been fixed in v0.12.0 (PR #449)...
CVE-2023-20254
A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to access another tenant that is being managed by the same Cisco Catalyst SD-WAN Manager instance. This vulnerability requires the multi-tenant...
CVE-2023-44158
CVE-2023-44158 affects Acronis Cyber Protect 15 (Linux, Windows) prior to build 35979. The root cause is insufficient masking of the token field, leading to potential disclosure of sensitive information. The CVE entry indicates a high confidentiality impact but does not detail exploitability; exp...
Essential Guide to Cybersecurity Compliance
SOC 2, ISO, HIPAA, Cyber Essentials – all the security frameworks and certifications today are an acronym soup that can make even a compliance expert's head spin. If you're embarking on your compliance journey, read on to discover the differences between standards, which is best for your business...
pohangport.com Cross Site Scripting vulnerability OBB-3710583
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-43256
Directory traversal in Gladys Assistant affects 4.26.1 and earlier (and is noted as still vulnerable in 4.27.0 and prior by multiple sources). The root cause is non-sanitized user input enabling an authenticated actor to read host files; exploitation status is not detailed in the provided documen...
CVE-2023-5129
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate of CVE-2023-4863. Recent assessments: RFCSVC at September 27, 2023 7:33pm UTC reported: Assessed Attacker Value: 5 Assessed Attacker Value: 5Assessed Attacker Value: 5...
CVE-2023-43640
CVE-2023-43640 describes an SQL injection in TaxonWorks prior to version 0.34.0, reported to allow authenticated attackers to extract arbitrary data from the TaxonWorks database (including the users table), leading to information disclosure. The fixed version is 0.34.0. Connected sources corrobor...
CVE-2023-43637
The CVE describes a cryptographic weakness in EVE’s deriveVaultKey used by the vault key derivation flow. Before version 7.10, the generated 32-byte vault key was weakened because deriveVaultKey calls retrieveCloudKey (which returns a fixed 32-byte key) and then merges it with the random 32-byte ...
CVE-2023-40368
IBM Storage Protect suffers an information-disclosure vulnerability (CVE-2023-40368) affecting multiple components: Storage Protect Client; Storage Protect for Space Management; Storage Protect for Virtual Environments (Hyper-V and VMware). A privileged user could obtain sensitive data via the Ad...
On the Cybersecurity Jobs Shortage
In April, Cybersecurity Ventures reported on extreme cybersecurity job shortage: Global cybersecurity job vacancies grew by 350 percent, from one million openings in 2013 to 3.5 million in 2021, according to Cybersecurity Ventures. The number of unfilled jobs leveled off in 2022, and remains at 3...
CVE-2023-39041
CVE-2023-39041 concerns the Line/KUKURUDELI platform. Multiple connected sources describe an information leak in KUKURUDELI Line v13.6.1 that enables attackers to obtain the channel access token and to send crafted messages. The core description across sources is consistent: an information disclo...
CVE-2023-41484
Technical details about CVE-2023-41484 are not publicly provided in the supplied documents. Monitor for updates from vendors and security trackers for affected versions, remediation, and exploit information.
CVE-2023-39044
CVE-2023-39044 concerns ajino-Shiretoko Line v13.6.1, where an information leak could let an attacker obtain the channel access token and send crafted messages. The root cause isn't explicitly stated in the provided documents. No exploit code/status is shown; mitigation guidance in PT-Security PT...
CVE-2023-39052
Summary: CVE-2023-39052 affects Earthgarden_waiting 13.6.1, describing an information disclosure that allows attackers to obtain the channel access token and send crafted messages. The NVD entry lists a MEDIUM severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N; base 6.5). Other connected sou...
CVE-2023-3892
CVE-2023-3892 affects MIM Assistant and MIM Client’s DICOM RTst Loading modules, via an improper restriction of XML External Entity (XXE) references. The root cause is handling of XML that can enable entity expansion when processing 3rd‑party private RTst metadata tags, potentially allowing an at...
CVE-2023-4095
CVE-2023-4095 describes a user enumeration vulnerability affecting Arconte Áurea version 1.5.0.0 (and prior), where an attacker could obtain a list of registered users, enabling further targeted attacks. The connected sources confirm the affected software and the nature of the impact, with public...