Protected Pages - Critical - Access bypass - SA-CONTRIB-2023-013

This module enables you to secure any page with a password. The module does not sufficiently restrict access to the page content...

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server’s server lies in the incorrect restriction on the path to the restricted-access catalog, which allows attackers to gain unauthorized access to protected information.

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server relates to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the Swarm Mode mode of the dockerd daemon in the software for creating containerized systems like Moby and the Mirantis Container Runtime environment allows a attacker to compromise the integrity of the protected information.

The vulnerability of the Swarm Mode mode of the dockerd daemon, a software tool for creating containerized systems like Moby and the Mirantis Container Runtime environment, is related to the use of an unprotected alternative channel. Exploiting this vulnerability allows an attacker to compromise...

PT-2023-2438 · Microsoft · Windows Dns Server +1

Name of the Vulnerable Software and Affected Versions: Windows DNS Server affected versions not specified Description: The issue is related to insufficient input validation in the Windows DNS Server component, allowing a remote attacker to disclose protected information. This can lead to the...

PT-2023-2301 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient protection of internal data in the Windows operating system, which can allow an attacker to gain unauthorized access to protected information. This can...

The vulnerability of the VMware HPE OneView for VMware vCenter management tool, related to insufficient protection of registration data, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the VMware HPE OneView for VMware vCenter management tool is related to insufficient protection for registration data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Freestyle Project Configuration Handler component of the Convert To Pipeline Plugin allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Freestyle Project Configuration Handler component of the Convert To Pipeline Plugin is related to improper code generation management. Exploiting this vulnerability can allow an attacker, operating remotely, to compromise the confidentiality, integrity, and accessibility ...

The vulnerability in the built-in screenshot editor of Android operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the built-in screenshot editor in Android operating systems is related to an incorrect file saving procedure after editing and replacing the original file. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected...

Download Manager Pro < 6.3.0 - Unauthenticated Sensitive Information Disclosure

The plugin leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files. PoC - Create a password protected package containing one or more files. - Navigate to the download page of the package e.g. /download/package1 -...

The vulnerability of Google Chrome’s Intents function allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Google Chrome’s Intents function is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a specially created web page...

The vulnerability of the QTS, QuTS hero, and QuTScloud operating systems relates to the execution of operations beyond the buffer in memory, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the QTS, QuTS hero, and QuTScloud operating systems is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of Google Chrome’s Safe Browsing service allows a hacker to expose protected information.

The vulnerability of Google Chrome’s Safe Browsing service exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to disclose protected information through a specially created web page...

The vulnerability of the FedCM component in the Google Chrome browser allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the FedCM component in the Google Chrome browser is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through...

CVE-2023-0652 Local Privilege Escalation in Cloudflare WARP Installer (Windows)

Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer MSI of WARP Client for Windows = 2022.12.582.0 allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, overwriting SYSTEM protected files. As...

Cloudflare WARP 后置链接漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connections from Cloudflare, Inc. in the United States. A security vulnerability exists in Cloudflare WARP versions prior to 2023.3.381.0, which originates from a hard link created during a software fix that allows a malicious...

CVE-2022-43664

A use-after-free vulnerability exists within the way Ichitaro Word Processor 2022, version 1.0.1.57600, processes protected documents. A specially crafted document can trigger reuse of freed memory, which can lead to further memory corruption and potentially result in arbitrary code execution. An...

Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks

An unknown threat actor used a malicious self-extracting archive SFX file in an attempt to establish persistent backdoor access to a victim's environment, new findings from CrowdStrike show. SFX files are capable of extracting the data contained within them without the need for dedicated software...

Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks

An unknown threat actor used a malicious self-extracting archive SFX file in an attempt to establish persistent backdoor access to a victim's environment, new findings from CrowdStrike show. SFX files are capable of extracting the data contained within them without the need for dedicated software...

Justsystem Ichitaro Protected Attribute Identifier Use-After-Free Vulnerablity

Talos Vulnerability Report TALOS-2022-1673 Justsystem Ichitaro Protected Attribute Identifier Use-After-Free Vulnerablity April 5, 2023 CVE Number CVE-2022-43664 SUMMARY A use-after-free vulnerability exists within the way Ichitaro Word Processor 2022, version 1.0.1.57600, processes protected...

The vulnerability of the Python Redis library, redis-py, allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Python Redis library, redis-py, is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...