Code injection

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached data of a user that has access. There ar...

CVE-2023-22469

CVE-2023-22469 affects Nextcloud Deck (Deck app for Nextcloud), where unauthorized users can access cached data when obtaining a reference preview for a Deck card to which they have no access. Root cause is leakage via the reference preview cache, enabling data exposure of another user’s cards. A...

CVE-2022-4338

CVE-2022-4338 is an integer underflow in Open vSwitch (Organization Specific TLV) affecting various Open vSwitch versions. Connected sources confirm the issue and link multiple vendor advisories. Impact is high per CVSS, with network attack vector and high confidentiality/integrity/availability i...

CVE-2022-4337

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2022-4338

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2022-4337

CVE-2022-4337 describes an out-of-bounds read in Open vSwitch’s Organization Specific TLV across various Open vSwitch versions. The related documents identify Open vSwitch as the affected product with the root cause being an out-of-bounds read in TLV handling, leading to high-severity impact (con...

CVE-2022-4338

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2022-4337

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2022-4337

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2022-4337

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch...

PT-2023-18520 · Nextcloud · Deck

Name of the Vulnerable Software and Affected Versions: Nextcloud app Deck versions prior to 1.8.2 Description: The issue affects Deck, a kanban style organization tool integrated with Nextcloud, used for personal planning and project organization for teams. When getting the reference preview for...

CVE-2022-4338

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2022-4338

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2023-22472

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. e.g. in an email, chat link...

CVE-2023-22472

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. e.g. in an email, chat link...

CVE-2023-22472

CVE-2023-22472 affects the Nextcloud Deck integration with the Nextcloud Desktop Client. The issue is a Cross-Site Request Forgery (CSRF) vulnerability that enables an attacker to induce a user to send a POST request with an arbitrary body by clicking a malicious deep link on Windows. Multiple so...

CVE-2023-22472 Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. e.g. in an email, chat link...

Russian Turla Hackers Hijack Decade-Old Malware Infrastructure to Deploy New Backdoors

The Russian cyberespionage group known as Turla has been observed piggybacking on attack infrastructure used by a decade-old malware to deliver its own reconnaissance and backdoor tools to targets in Ukraine. Google-owned Mandiant, which is tracking the operation under the uncategorized cluster...

Enforcement vs. Enrollment-based Security: How to Balance Security and Employee Trust

Challenges with an enforcement-based approach An enforcement-based approach to security begins with a security policy backed by security controls, often heavy-handed and designed to prevent employees from engaging in risky behavior or inadvertently expanding the potential attack surface of an...

iaato.org Cross Site Scripting vulnerability OBB-3127433

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...