CVE-2023-1521

CVE-2023-1521 affects the sccache project on Linux. The vulnerability allows a local attacker to execute arbitrary code with the privileges of a local sccache server by preloading a shared library via LD_PRELOAD. If the server runs as root (default when installed via the snap package), a normal u...

CVE-2022-43937

CVE-2022-43937 corresponds to a log file information exposure in Brocade SANnav. Connected documents confirm that sensitive fields can be recorded in debug-enabled logs when debugging is on, affecting SANnav versions prior to 2.3.0 and 2.2.2a. The entries consolidate multiple advisories across Re...

CVE-2022-43935

The CVE-2022-43935 entry describes an information exposure in Brocade SANnav prior to version 2.2.2, where Fabric OS switch passwords and authorization IDs are printed in the embedded MLS DB file. This local-attack surface could lead to disclosure of sensitive credentials (confidentiality impact ...

CVE-2022-43934

The CVE-2022-43934 entry concerns Brocade SANnav before version 2.2.2 that supports weak key exchange algorithms. Affected component: Brocade SANnav (Fibre Channel management platform). Impact as stated: weak key exchange on specific ports (24, 6514, 18023, 19094, 19095) which could expose confid...

CVE-2022-43933

CVE-2022-43933 affects Brocade SANnav prior to version 2.2.2. The vulnerability is an information exposure through log files: the supportsave/log data may contain configuration secrets such as usernames, passwords, and secret keys. Affects SANnav deployments where a log file generated by an admin...

CVE-2023-21270

CVE-2023-21270 affects Android’s PermissionManagerServiceImpl.java, specifically in restorePermissionState, where a flaw can allow an app to retain permissions that should be revoked due to incorrect permission flag clearance during an update. This can lead to local elevation of privilege with Us...

On November 13, NIST NVD finally admitted the obvious: they had failed to process the CVE analysis backlog before the end of the fiscal year (September 30)

On November 13, NIST NVD finallyadmittedthe obvious: they had failed to process the CVE analysis backlog before the end of the fiscal year September 30. This is actually visible in their own statistics. At the moment, there are 19860 identifiers in the backlog. This week, 1136 new CVEs were...

CVE-2023-43091

GNOME Maps (GNOME Maps) is affected by CVE-2023-43091 due to a code injection flaw in its service.json configuration file. A malicious configuration can cause arbitrary code execution, as documented across multiple sources in the connected data. The issue is confirmed by CVE descriptions and rela...

CVE-2024-0793

CVE-2024-0793 – Kubernetes kube-controller-manager DoS (KCM pods churn) Affects kube-controller-manager where applying an HPA YAML without a .spec.behavior.scaleUp block can cause denial of service via KCM pods restarting (restart churn). The issue is documented in multiple sources, with IBM X-Fo...

CVE-2023-6110

OpenStack CVE-2023-6110 describes a flaw where deleting a non-existent access rule within a scope can cause other existing access rules (not linked to any application credentials) to be deleted. The vulnerability is linked to the OpenStack component handling access rule deletion. The documented i...

CVE-2023-4639

Undertow contains a flaw in how cookies with certain value-delimiting characters are parsed from incoming requests. The issue can allow an attacker to construct a cookie value to exfiltrate HttpOnly cookies or spoof additional cookie values, leading to unauthorized data access or modification. Th...

CVE-2023-20004

Three Cisco CVEs (CVE-2023-20004, CVE-2023-20092, CVE-2023-20093) affect the CLI of Cisco TelePresence CE and RoomOS. The root cause is improper access controls on local filesystem files, enabling an authenticated, local attacker to overwrite arbitrary files by placing a symbolic link in a specif...

CVE-2023-20036

CVE-2023-20036 affects Cisco Industrial Network Director (IND). The issue is in the web UI and arises from improper input validation during Device Pack uploads, allowing an authenticated, remote attacker to inject commands and execute arbitrary code with NT AUTHORITY\SYSTEM privileges on the devi...

CVE-2023-20039

CVE-2023-20039 – Cisco IND : A vulnerability in Cisco Industrial Network Director (IND) allows an authenticated, local attacker to read files in the application data directory due to insufficient default file permissions. This could enable viewing sensitive information. Cisco states software upda...

CVE-2023-20091

CVE-2023-20091 affects Cisco TelePresence CE and RoomOS. A vulnerability in the CLI allows an authenticated, local attacker to overwrite arbitrary files on the device’s local filesystem by placing a symbolic link in a specific location, due to improper access controls on local files. Impact is lo...

CVE-2023-20092

Cisco TelePresence CE and RoomOS CLI have three local arbitrary file-write vulnerabilities (CVE-2023-20092) due to improper local file access controls. An authenticated, local attacker could place a symbolic link to overwrite arbitrary files; exploitation requires a remote support user account. A...

CVE-2023-20093

CVE-2023-20093 : Three vulnerabilities in the Cisco TelePresence CE and RoomOS CLI could allow an authenticated, local attacker to overwrite arbitrary files on the local file system by placing a symbolic link in a specific location. Root cause: improper access controls on local files. Preconditio...

CVE-2023-20094

This CVE (CVE-2023-20094) affects Cisco TelePresence CE and Cisco RoomOS. The issue is caused by improper bounds checks in the affected software, enabling an unauthenticated, adjacent attacker to send a crafted request that can trigger an out-of-bounds read, potentially disclosing sensitive infor...

CVE-2023-20125

Cisco BroadWorks Network Server TCP Denial of Service vulnerability (CVE-2023-20125) arises from missing rate limiting for certain inbound TCP connections, allowing unauthenticated remote attackers to exhaust server resources and render the system unusable. Affected component is the local interfa...

CVE-2023-20154

CVE-2023-20154 affects Cisco Modeling Labs external authentication. An unauthenticated, remote attacker could log in to the web interface with administrative privileges by exploiting improper handling of messages from the external authentication server. The attack requires valid credentials store...