CVE-2023-40123

CVE-2023-40123 affects the PipMenuView.java component in the Android framework, with a bug in updateActionViews that allows a confused deputy to bypass a multi-user security boundary, causing local information disclosure without extra execution privileges. Exploitation requires no user interactio...

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, and Adobe Acrobat 2020/Adobe Acrobat Reader 2020 are related to lack of access control mechanisms. This allows attackers to bypass security restrictions.

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2020, and Adobe Acrobat Reader 2020 are related to lack of access control mechanisms. Exploiting these vulnerabilities can allow attackers to bypass securi...

Security Bulletin: A vulnerability in IBM Java Runtime may affect Tivoli Netcool/OMNIbus

Summary There is a vulnerability in the Eclipse OpenJ9 runtime that may affect the MibManager GUI application that is shipped with Tivoli Netcool/OMNbus. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by...

CVE-2023-43045 IBM Sterling Partner Engagement Manager security bypass

IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896...

CVE-2023-43045 IBM Sterling Partner Engagement Manager security bypass

IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896...

CVE-2023-38735

IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a victim to a phishing site. IBM X-Force ID: 262482...

CVE-2023-38735 IBM Cognos Dashboards improper authentication

IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a victim to a phishing site. IBM X-Force ID: 262482...

The vulnerability of Juniper Networks JunOS Evolved router series PTX10003 operating systems, related to deficiencies in the data source verification mechanism, allows attackers to circumvent security restrictions and cause service failures.

The vulnerability of Juniper Networks JunOS Evolved router series, PTX10003, is related to deficiencies in the mechanism for verifying data sources during MAC address processing. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and cause service failures...

Oracle MySQL Enterprise Monitor (October 2023 CPU)

The versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory. - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL component: Monitoring: General Apache Struts. Supported versions...

nodejs: integrity checks according to policies can be circumvented

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to node's policy implementation, thus effectively disabling the integrity check...

CVE-2023-4399

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypassed used punycode encoding of the...

CVE-2023-43668 Apache InLong: Jdbc Connection Security Bypass in InLong

Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile".... . Users are advised to upgrade to Apache InLong's 1.9.0 or...

CVE-2023-43668 Apache InLong: Jdbc Connection Security Bypass in InLong

Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile".... . Users are advised to upgrade to Apache InLong's 1.9.0 or...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of authentication procedures, which allow attackers to circumvent existing security restrictions.

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow a malicious actor to circumvent existing security restrictions remotely...

CVE-2023-38220

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this...

CVE-2023-38220

Adobe Commerce / Magento Open Source versions 2.4.7-beta1 and earlier (including 2.4.6-p2, 2.4.5-p4, 2.4.4-p5 and earlier) are affected by an Improper Authorization vulnerability that can bypass security features to access unauthorized data, with exploitation not requiring user interaction. Conne...

CVE-2023-38220 Full page cache enumeration via cookie X-Magento-Vary

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this...

The vulnerability of the Search component of the Windows operating system, which allows a hacker to bypass security restrictions

The vulnerability of the WordPad text editor on the Windows operating system is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions from a remote location...

The vulnerability of the web interface of the administration and service portal of Atos Unify OpenScape Common Management Platform allows a perpetrator to bypass security restrictions and execute arbitrary codes.

The vulnerability of the web interface of the administration and service portal of Atos Unify OpenScape Common Management Platform is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker to circumvent security restrictions and execute...

CVE-2023-5485

Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. Chromium security severity: Low...