17612 matches found
CVE-2023-35124
Open Automation Software OAS Platform v18.00.0072 is affected by CVE-2023-35124 in the Engine configuration management functionality. A specially crafted sequence of network requests can disclose sensitive information stored by the OAS Platform. Talos’ vulnerability report confirms the vulnerabil...
CVE-2023-34353
CVE-2023-34353 affects Open Automation Software OAS Platform OAS Engine authentication functionality (v18.00.0072). Talos details describe an authentication bypass enabling information disclosure by sniffing network traffic to decrypt sensitive data, with the vulnerability tied to how credentials...
CVE-2023-38569
CVE-2023-38569 is a stored XSS vulnerability affecting SHIRASAGI prior to version 1.18.0. An authenticated user can trigger arbitrary script execution in the web browser of the logged-in user. Public details confirm the affected software is SHIRASAGI and the workaround/mitigation is to upgrade to...
Summary of Vulnerabilities, Actors & Attacks: August 2023
...
CVE-2023-41057
Hyper-bump-it contains a Path Traversal vulnerability due to not checking that the globbed files reside under the project root. The code joins project root with a config-supplied string to build the target path, which can cause edits to files outside the project. The issue is fixed in release v0....
CVE-2023-2813
CVE-2023-2813 describes a reflected XSS in multiple WordPress themes (e.g., Aapna, Anand, Anfaust, Arendelle, etc.) up to varying versions (as listed in the description). The issue arises from the search box reflecting results, allowing an unauthenticated attacker to lure users into clicking a ma...
CVE-2023-32806
creationtimestamp| type| source ---|---|--- 2023-09-04 07:15:58+00:00| seen| https://t.me/cibsecurity/69714...
CVE-2023-20836
CVE-2023-20836 affects the CAMSYS component. The vulnerability is an out-of-bounds read caused by a missing bounds check, which could lead to local information disclosure with System execution privileges; exploitation reportedly does not require user interaction. The documented patch reference is...
blitzwolf.de Cross Site Scripting vulnerability OBB-3632220
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-4721
The CVE-2023-4721 issue affects gpac/gpac, with the vulnerable release prior to 2.3-DEV. The primary public description notes an out-of-bounds read in gpac/gpac before 2.3-DEV. A PT-Security entry (PT-2023-5249) adds detail about the affected component is filters/mux isom.c and mentions a potenti...
CVE-2023-4720
CVE-2023-4720 describes a vulnerability in gpac/gpac prior to version 2.3-DEV where a floating point comparison uses an incorrect operator. The issue can impact availability (per CVSS note: base score 5.5, MEDIUM) with a LOCAL attack vector, LOW attack complexity, and user interaction required. R...
Spyware Vendor Hacked
A Brazilian spyware app vendor was hacked by activists: In an undated note seen by TechCrunch, the unnamed hackers described how they found and exploited several security vulnerabilities that allowed them to compromise WebDetetive’s servers and access its user databases. By exploiting other flaws...
heap-use-after-free in mp4_mux_process_fragmented filters/mux_isom.c:6634
Description heap-use-after-free in MP4Box. Version $ ./bin/gcc/MP4Box -version MP4Box - GPAC version 2.3-DEV-revrelease c 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io Please cite our work in your research: GPAC Filters: https://doi.org/10.1145/3339825.3394929 GPAC:...
CVE-2023-36088
NebulaGraph Studio 3.7.0 is affected by a Server Side Request Forgery (SSRF) vulnerability. Connected sources consistently describe SSRF leading to sensitive information disclosure. The exact root cause within the implementation, affected components, and a formal remediation/fix version are not d...
CVE-2023-39356
CVE-2023-39356: FreeRDP contains a missing offset validation in gdi_multi_opaque_rect. The boundary check for multi_opaque_rect->numRectangles is absent, enabling an Out-Of-Bounds Read that can crash the client. Documents specify this issue is addressed in versions 2.11.0 and 3.0.0-beta3. The ...
CVE-2023-41751
CVE-2023-41751 affects Acronis Agent (Windows) before build 32047. The root cause is improper token expiration validation, enabling potential disclosure of sensitive information (confidentiality impact: HIGH). The vulnerability is local in nature (attack vector: LOCAL) with low privileges require...
CVE-2023-41745
CVE-2023-41745 affects Acronis Agent (Linux, macOS, Windows) before build 30991 and Acronis Cyber Protect 15 before build 35979. The underlying issue is excessive collection of system information, causing disclosure of sensitive data. Exploitation details are not provided in the connected documen...
Input validation
An improper error handling vulnerability in the component ErroreNonGestito.aspx of GruppoSCAI RealGimm 1.1.37p38 allows attackers to obtain sensitive technical information via a crafted SQL query...
left shift of negative value in scene_manager/swf_parse.c:213:12
Description left shift of negative value in MP4Box Version $ ./bin/gcc/MP4Box -version MP4Box - GPAC version 2.3-DEV-revrelease c 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io Please cite our work in your research: GPAC Filters: https://doi.org/10.1145/3339825.3394929 GPAC...