CVE-2023-22250

Adobe Commerce Open Source/Commerce (Magento) suffers an Improper Access Control vulnerability (CVE-2023-22250) affecting 2.4.4-p2 and earlier and 2.4.5-p1 and earlier. The issue could allow a security feature bypass and impact availability of a user’s minor feature without user interaction. CVSS...

CVE-2023-22251 Adobe Commerce Incorrect Authorization Security feature bypass

Adobe Commerce versions 2.4.4-p2 and earlier and 2.4.5-p1 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged authenticated attacker could leverage this vulnerability to achieve minor information disclosure...

The vulnerability in the implementation of the Google Chrome browser’s Web Payments application interface allows a perpetrator to circumvent security restrictions.

The vulnerability of the Google Chrome browser’s Web Payments application interface is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions through a specially created HTML page...

CVE-2023-20860

CVE-2023-20860 affects Spring Framework 6.0.0–6.0.6 and 5.3.0–5.3.25 where using ** as a pattern in Spring Security’s mvcRequestMatcher can cause a mismatch with Spring MVC pattern matching, creating a potential security bypass. Remediation: upgrade to fixed releases; IBM’s advisory notes a patch...

KLA90886 DoS vulnerability in Microsoft Mariner

Denial of service vulnerability was found in Microsoft Mariner. Malicious users can exploit this vulnerability to cause denial of service, bypass security restrictions. Original advisories CVE-2023-0464 Exploitation Public exploits exist for this vulnerability. Related products CBL-Mariner-2.0 CV...

The vulnerability of the Google Chrome browser’s Navigation function, which allows a hacker to bypass security restrictions

The vulnerability of Google Chrome’s Navigation function is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions using a specially created HTML page...

The vulnerability of the UPSMON Pro monitoring system, related to errors in processing the relative path to the restricted-access catalog, allows a perpetrator to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of the UPSMON Pro monitoring system is related to errors in processing the relative path to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions and gain unauthorized access to protected information...

The vulnerability in the implementation of Google Chrome’s browser extension programming interface allows a perpetrator to circumvent security restrictions.

The vulnerability of Google Chrome’s application programming interface extensions is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions by downloading specially created extensions...

KLA90968 DoS vulnerability in Microsoft Mariner

Denial of service vulnerability was found in Microsoft Mariner. Malicious users can exploit this vulnerability to cause denial of service, bypass security restrictions. Original advisories CVE-2023-0464 Exploitation Public exploits exist for this vulnerability. Related products CBL-Mariner-2.0 CV...

Researchers Uncover Chinese Nation State Hackers' Deceptive Attack Strategies

A recent campaign undertaken by Earth Preta indicates that nation-state groups aligned with China are getting increasingly proficient at bypassing security solutions. The threat actor, active since at least 2012, is tracked by the broader cybersecurity community under Bronze President, HoneyMyte,...

Exploit for CVE-2023-20860

For studying CVE-2023-20860: Security Bypass With Un-Prefixe...

KLA48688 RCE vulnerability in LibreOffice

Remote code execution vulnerability was found in LibreOffice. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories Empty entry in Java class path risks arbitrary code execution Related products LibreOffice CVE list CVE-2022-38745 critical Solution Update t...

Security Bulletin: IBM Tivoli Application Dependency Discovery Manager is vulnerable to a bypass vulnerability due to the use of Python (CVE-2023-24329)

Summary A publicly disclosed vulnerability in Python affects IBM Tivoli Application Dependency Discovery Manager CVE-2023-24329 Vulnerability Details CVEID:CVE-2023-24329 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by a flaw in the urllib.parse...

CVE-2023-28434

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials wit...

CVE-2023-22271

Experience Manager versions 6.5.15.0 and earlier are affected by a Weak Cryptography for Passwords vulnerability that can lead to a security feature bypass. A low-privileged attacker can exploit this in order to decrypt a user's password. The attack complexity is high since a successful...

CVE-2023-22263 AEM URL Redirection to Untrusted Site Security feature bypass

Experience Manager versions 6.5.15.0 and earlier are affected by a URL Redirection to Untrusted Site 'Open Redirect' vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interactio...

CVE-2023-22261 AEM URL Redirection to Untrusted Site Security feature bypass

Experience Manager versions 6.5.15.0 and earlier are affected by a URL Redirection to Untrusted Site 'Open Redirect' vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interactio...

VMware Spring Framework 5.3.x < 5.3.26, 6.0.x < 6.0.7 Security Bypass Vulnerability - Linux

The VMware Spring Framework is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

VMware Spring Framework 5.3.x < 5.3.26, 6.0.x < 6.0.7 Security Bypass Vulnerability - Windows

The VMware Spring Framework is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Emotet Rises Again: Evades Macro Security via OneNote Attachments

The notorious Emotet malware, in its return after a short hiatus, is now being distributed via Microsoft OneNote email attachments in an attempt to bypass macro-based security restrictions and compromise systems. Emotet, linked to a threat actor tracked as Gold Crestwood, Mummy Spider, or TA542,...