CVE-2023-23626 Denial of service when feeding malformed size arguments in go-bitfield

go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics. This happen when the size is a not a multiple of 8...

CVE-2023-23631 HAMT Decoding Panics in github.com/ipfs/go-unixfsnode

github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an...

PT-2023-19086 · Unknown · Go-Bitfield

Name of the Vulnerable Software and Affected Versions: go-bitfield affected versions not specified Description: The issue arises when untrusted user input is fed into the size parameter of NewBitfield and FromBytes functions, allowing an attacker to trigger panics. This occurs when the size is no...

PT-2023-33053 · Openssl · Openssl

Name of the Vulnerable Software and Affected Versions: OpenSSL versions prior to 1.1.0 Description: A null pointer in OpenSSL can be dereferenced when signatures are being verified in malformed PKCS7 data, potentially causing unexpected crashes in agents or clients compiled with OpenSSL...

PT-2023-18203 · Smr · Smr

Name of the Vulnerable Software and Affected Versions: Phone application versions prior to SMR Feb-2023 Release 1 Description: The issue is related to improper access control, allowing local attackers to access sensitive information. This is achieved via implicit broadcast. Recommendations: For...

PT-2023-1526 · Trend Micro · Trend Micro Apex One

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex One affected versions not specified Description: The issue is related to improper access control in the Trend Micro Apex One agent, which could allow a local attacker to gain elevated privileges. This can enable the creation ...

PT-2023-18193 · Smr · Smr

Name of the Vulnerable Software and Affected Versions: SMR versions prior to Jan-2023 Release 1 Description: A hardcoded AES key is used to encrypt card emulation PINs in NFC, allowing attackers to access the PIN. Recommendations: For versions prior to Jan-2023 Release 1, update to Jan-2023 Relea...

PT-2023-18215 · Samsung · Samsung Cloud

Name of the Vulnerable Software and Affected Versions: Samsung Cloud versions prior to 5.3.0.32 Description: A path traversal issue exists, allowing an attacker to access a specific png file. Recommendations: For versions prior to 5.3.0.32, update to version 5.3.0.32 or later to resolve the issue...

PT-2023-18191 · Unknown · Semchameleonhelper

Name of the Vulnerable Software and Affected Versions: SemChameleonHelper versions prior to SMR Jan-2023 Release 1 Description: The issue is related to improper handling of insufficient permissions or privileges, allowing an attacker to modify network-related values, network code, carrier ID, and...

PT-2023-18194 · Nfctile · Nfctile

Name of the Vulnerable Software and Affected Versions: NfcTile versions prior to SMR Jan-2023 Release 1 Description: The issue is related to improper access control, allowing an attacker to use NFC without user recognition. Recommendations: For versions prior to SMR Jan-2023 Release 1, update to...

PT-2023-3369 · Ls Electric · Ls Electric Xbc-Dn32U

Name of the Vulnerable Software and Affected Versions: LS ELECTRIC XBC-DN32U version 01.80 Description: The issue is related to the lack of authentication for a critical function in the LS ELECTRIC XBC-DN32U, specifically its deletion command. This could allow an attacker to delete arbitrary file...

PT-2023-18186 · Samsung · Secure Folder

Name of the Vulnerable Software and Affected Versions: Secure Folder versions prior to SMR Jan-2023 Release 1 Description: The issue is caused by an improper implementation logic in Secure Folder, which allows the Secure Folder container to remain unlocked under certain conditions. Recommendation...

PT-2023-16453 · WordPress · Wicked Folders

Name of the Vulnerable Software and Affected Versions: Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description: The issue is related to a missing capability check on the ajax unassign folders function, which allows authenticated attackers with subscriber-level...

PT-2023-1843 · B&R · B&R Aprol

Name of the Vulnerable Software and Affected Versions: B&R APROL versions prior to R 4.2-07 Description: The issue is related to missing authentication when creating and managing the B&R APROL database, allowing unauthorized reading and modification of system configuration. This can be exploited...

PT-2023-16480 · WordPress · Wicked Folders

Name of the Vulnerable Software and Affected Versions: Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description: The issue is due to missing or incorrect nonce validation on the ajax clone folder function, making it possible for unauthenticated attackers to invoke th...

PT-2023-19951 · Formula · Formula

Name of the Vulnerable Software and Affected Versions: formula versions prior to 3.0.1 Description: The issue arises when crafted user-provided strings are parsed by the formula parser, potentially leading to polynomial execution time and a denial of service. There are no known workarounds for th...

PT-2023-14596 · Unknown · Smartpower Web

Name of the Vulnerable Software and Affected Versions: Smartpower Web versions prior to 23.01.01 Description: The issue is related to Improper Input Validation, which allows PHP Local File Inclusion in Smartpower Web. This can potentially be exploited due to the lack of proper validation of user...

PT-2023-1741 · B&R · B&R Aprol Tbase Server

Name of the Vulnerable Software and Affected Versions: B&R APROL Tbase server versions prior to R 4.2-07 Description: The issue is caused by a lack of verification in the B&R APROL Tbase server, which may lead to memory leaks when receiving messages. This can be exploited by a remote attacker to...

PT-2023-14595 · Unknown · Smartpower Web

Name of the Vulnerable Software and Affected Versions: Smartpower Web versions prior to 23.01.01 Description: The issue affects Smartpower Web, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. This enables attackers to inject malicious scripts...

PT-2023-14599 · Unknown · Smartpower Web

Name of the Vulnerable Software and Affected Versions: Smartpower Web versions prior to 23.01.01 Description: The issue is related to an Improper Input Validation vulnerability that allows SQL Injection in Smartpower Web. This vulnerability can be exploited due to the lack of proper validation of...