17615 matches found
CVE-2022-42500
creationtimestamp| type| source ---|---|--- 2023-03-24 23:47:57+00:00| seen| https://t.me/cibsecurity/60695 2025-02-25 15:23:18+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5300...
CVE-2023-21014
In multiple locations of p2piface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...
CVE-2020-11311
creationtimestamp| type| source ---|---|--- 2023-03-24 05:48:02+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2299 2024-11-25 04:55:02+00:00| seen| https://infosec.exchange/users/cve/statuses/113541808277553698...
CVE-2022-20467
The CVE-2022-20467 issue affects Android 11–13 where the function isBluetoothShareUri in BluetoothOppUtility.java can read files incorrectly due to a confused deputy, causing local information disclosure with no extra execution privileges. Exploitation requires user interaction, with local attack...
CVE-2023-21007
The CVE-2023-21007 entry affects Android 13 and is caused by a missing bounds check in p2p_iface.cpp, resulting in an out-of-bounds read that can lead to local information disclosure with system privileges. The issue is exploitable locally, with no user interaction required, and is tied to the p2...
CVE-2023-20991
CVE-2023-20991 corresponds to a buffer/bounds issue in the Pixel ble_scanner_hci_interface.cc function btm_ble_process_periodic_adv_sync_lost_evt. The vulnerability is an out-of-bounds read that could enable local information disclosure with System privileges and requires no user interaction. Evi...
CVE-2023-20973
CVE-2023-20973 affects Android 13, specifically the Bluetooth stack: in btm_create_conn_cancel_complete() of btm_sec.cc, a missing bounds check enables an out-of-bounds read. This can lead to local information disclosure with SYSTEM-level privileges needed; exploitation reportedly does not requir...
CVE-2022-45597
The CVE-2022-45597 entry concerns ComponentSpace.Saml2 4.4.0 with missing SSL certificate validation at the application layer. Root cause: improper handling of SSL certificates within the library, contrasted with transport-layer validation. Impact is described as high confidentiality, integrity, ...
CVE-2023-28442
CVE-2023-28442 affects GeoNode (3 and 4) where anonymous users can retrieve sensitive configuration information from the Geoserver REST endpoint /geoserver/rest/about/status. Versions before 2.20.7 (also 2.19.6/2.18.7) are exposed due to Geoserver configuration for GeoNode leaving REST endpoints ...
CVE-2023-24787
CVE-2023-24787 is a duplicate of CVE-2023-24685 and the record is marked as such in the description. Connected sources provide concrete details about ChurchCRM SQL injection via the Event parameter in the /churchcrm/EventAttendance.php endpoint (param Event) used after authentication. The vulnera...
CVE-2023-20859
CVE-2023-20859 affects Spring Vault: 3.0.x prior to 3.0.2 and 2.3.x prior to 2.3.3 (and older versions). The issue allows insertion of sensitive information into log files when revoking a Vault batch token, potentially exposing confidential data on local systems. The NVD metrics show a Local, Low...
CVE-2023-27079
CVE-2023-27079 concerns the Tenda G103 router (v1.0.05). The connected sources consistently confirm a command injection vulnerability in this device, exploitable via a crafted packet over the network. The underlying impact is confidentiality loss (sensitive information leakage); CVSS-based data i...
CVE-2023-28117
CVE-2023-28117 affects the Sentry SDK for Python (Django integration) prior to 1.14.0. When sendDefaultPII is True and a custom SESSION_COOKIE_NAME or CSRF_COOKIE_NAME is used, cookies (including session cookies) can be leaked to Sentry, potentially enabling impersonation or privilege escalation ...
CVE-2023-28708
CVE-2023-28708 affects Apache Tomcat where RemoteIpFilter processed requests from reverse proxies with X-Forwarded-Proto: https, causing session cookies to be set without the secure attribute across several lines of Tomcat releases (8.5.0–8.5.85, 9.0.0-M1–9.0.71, 10.1.0-M1–10.1.5, 11.0.0-M1–11.0....
Google Pixel: Cropped or edited images can be recovered
Most of us have a camera on us at all times, and so photo taking and image sharing has become almost ubiquitous. But when sharing an image, you want to have control over what you share. And that might lead you to crop images, or redact parts of them. Maybe you cropped out a person that didn't wan...
CVE-2023-22269 AEM Reflected XSS Arbitrary code execution
Experience Manager versions 6.5.15.0 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...
Nextcloud: End-to-end encrypted file-drops can be made inaccessible
An end-to-end encrypted file-drop vulnerability allowed attackers to modify the metadata file and make the uploaded file inaccessible. The vulnerability could break the availability of the file. The issue was resolved by not providing the metadata file to the user and appending the new entry in t...
sarahlynnstudios.com Cross Site Scripting vulnerability OBB-3229366
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...