CVE-2023-41893

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

CVE-2023-5449: Undefined Security Weakness

A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a monitor’s Theft Deterrence to be deactivated...

CVE-2023-44464: Undefined Security Weakness

pretix before 2023.7.2 allows Pillow to parse EPS files...

The vulnerability of Google Chrome’s Autofill function allows attackers to bypass existing security restrictions.

The vulnerability of Google Chrome’s Autofill function is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions through a specially created HTML page...

PT-2023-28370 · Unknown · Soundminer

Name of the Vulnerable Software and Affected Versions: Soundminer affected versions not specified Description: The issue is related to improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This is a type of security weakness that can allow an attacker to...

CVE-2023-41996: Undefined Security Weakness

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6. Apps that fail verification checks may still launch...

Design/Logic Flaw

UNSUPPPORTED WHEN ASSIGNED Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the we...

CVE-2023-4581: Undefined Security Weakness

Excel .xll add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2...

Exploit for Insecure Default Initialization of Resource in Apache Superset

CVE-2023-27524: Apache Superset Auth Bypass and RCE Apache Su...

CVE-2023-4324: Undefined Security Weakness

Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers...

CVE-2023-4338: Undefined Security Weakness

Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers...

CVE-2023-4325: Undefined Security Weakness

Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilities...

CVE-2023-37513: Undefined Security Weakness

When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information...

CVE-2023-40267: Undefined Security Weakness

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

CVE-2022-2346: Undefined Security Weakness

In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints...

CVE-2023-38601: Undefined Security Weakness

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to modify protected parts of the file system...

CVE-2023-38564: Undefined Security Weakness

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. An app may be able to modify protected parts of the file system...

Microsoft validation error allowed state actor to access user email of government agencies and others

Microsoft is getting criticized for the way in which it handled a serious security incident that allowed a suspected Chinese espionage group to access user email from approximately 25 organizations, including government agencies and related consumer accounts in the public cloud. The attacks were...

CVE-2023-22052: Undefined Security Weakness

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.19 and 21.3-21.10. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to...

PT-2023-25299 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF. Recommendations: At the...