PT-2023-18077 · Slice · Slice

Name of the Vulnerable Software and Affected Versions: Slice affected versions not specified Description: The issue in Slice involves a possible disclosure of installed applications due to side channel information disclosure, which could lead to local escalation of privilege without requiring...

PT-2023-18078 · Google · Android

Name of the Vulnerable Software and Affected Versions: Package Manager affected versions not specified Description: The issue allows an attacker to determine whether an app is installed without query permissions, due to side channel information disclosure. This could lead to local information...

PT-2023-18104 · Unknown · Package Installer

Name of the Vulnerable Software and Affected Versions: Package Installer affected versions not specified Description: The issue is related to a missing permission check in Package Installer, allowing an attacker to determine whether an app is installed without query permissions. This could lead t...

PT-2023-18125 · Unknown · Package Manager

Name of the Vulnerable Software and Affected Versions: Package Manager affected versions not specified Description: The issue allows an attacker to determine whether an app is installed without query permissions, due to side channel information disclosure. This could lead to local information...

PT-2023-18095 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a side channel information disclosure in the UsageStatsService, which could allow reading installed 3rd party apps. This leads to local information disclosure withou...

CVE-2023-21298: Observable Discrepancy

In Slice, there is a possible disclosure of installed applications due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-18105 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a missing permission check in Activity Manager, which could allow an attacker to determine whether an app is installed. This could lead to local information disclosu...

Fedora 38 : dotnet7.0 (2023-c132c84fcf)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-c132c84fcf advisory. This the October 2023 monthly update for .NET 7 Release Notes: https://github.com/dotnet/core/blob/main/release-notes/7.0/7.0.12/7.0.12.md Tenable has...

SentinelOne Agent Installed (Windows)

Binary data sentineloneagentwininstalled.nbin...

CVE-2023-4668

The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins present and active, active theme,...

CVE-2023-4668 Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe

The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins present and active, active theme,...

CVE-2023-43800

Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint "/v2/pkgs/tools/installed". A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to thos...

CVE-2023-43801

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint "/v2/pkgs/tools/installed" and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass...

CVE-2023-43803

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint "/v2/pkgs/tools/installed" and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass...

ImageMagick Installed (macOS)

Binary data imagemagickmacosinstalled.nbin...

PT-2023-28996 · Arduino · Arduino Create Agent

Name of the Vulnerable Software and Affected Versions: Arduino Create Agent versions prior to 1.3.3 Description: The issue affects the endpoint "/v2/pkgs/tools/installed" and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localho...

Arduino path traversal vulnerability

Arduino is a microcontroller board from the Arduino project. A security vulnerability exists in Arduino Create Agent versions prior to 1.3.2, which stems from a security flaw in the /v2/pkgs/tools/installed endpoint. An attacker can exploit this vulnerability by constructing HTTP requests...

PT-2023-28993 · Arduino · Arduino Create Agent

Name of the Vulnerable Software and Affected Versions: Arduino Create Agent versions prior to 1.3.3 Description: The issue affects the endpoint "/v2/pkgs/tools/installed". A user who can perform HTTP requests to the localhost interface, or bypass the CORS configuration, can escalate privileges to...

Arduino Data Forgery Issue Vulnerability

Arduino is a microcontroller board from the Arduino project. A security vulnerability exists in Arduino Create Agent versions prior to 1.3.2, which stems from a security hole in the /v2/pkgs/tools/installed endpoint. An attacker can exploit this vulnerability to bypass CORS configuration and...

CVE-2023-43800: Insufficient Verification of Data Authenticity

Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint /v2/pkgs/tools/installed. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those ...