CVE-2023-27755

go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...

CVE-2023-27755

CVE-2023-27755 (go-bbs v1) is an arbitrary file download vulnerability in the /api/v1/download component. The connection between the affected code path and unauthorized file access is stated across multiple sources, with the root issue described as an arbitrary file download via the download endp...

CVE-2023-27755

go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...

CVE-2022-45173: Improper Authentication

An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /api/v1/vdeskintegration/challenge endpoint. Because only the client-side verifies whether a check was successful, an attacker can modify the response, and fool the...

CVE-2022-45180: Undefined Security Weakness

An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskDOMAIN/export endpoint. A malicious user, authenticated to the product without any specific privilege, can use the API for exporting information about all users of the system a...

CVE-2022-45170: Use of a Broken or Risky Cryptographic Algorithm

An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malicious user, logged into a victim's account, is able to decipher a file without knowing the key set by the user...

CVE-2023-27159: Server-Side Request Forgery (SSRF)

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

CVE-2023-27159

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

[SECURITY] Fedora 38 Update: wf-recorder-0.3.1-0.3.20221225gita9725f7.fc38

wf-recorder is a utility program for screen recording of wlroots-based compositors more specifically, those that support wlr-screencopy-v1 and xdg-output...

GSD-2023-1002391 xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()

xfrm/compat: prevent potential spectre v1 gadget in xfrmxlate32attr This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.168 by commit...

PT-2023-35414

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.1.12 Description The issue concerns a potential Spectre v1 gadget in the xfrm xlate32 attr function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel version...

SUSE CVE-2014-0222

Integer overflow in the qcowopen function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service crash via a large L2 table in a QCOW version 1 image...

SUSE CVE-2018-5382

The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47...

SUSE CVE-2021-4154

A use-after-free flaw was found in cgroup1parseparam in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service ...

The vulnerability in the strcmp() function of the httpd daemon of the microprogrammed router software for TP-Link Archer C5 version 2 and TP-Link WR710N version 1 allows a hacker to gain unauthorized access to protected information.

The vulnerability of the strcmp function in the httpd daemon of TP-Link Archer C5 version 2 and TP-Link WR710N version 1 is related to the creation of a secondary synchronization channel due to time differences. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...

GSD-2023-1002248 ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()

ipv4: prevent potential spectre v1 gadget in ipmetricsconvert This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.272 by commit...

GSD-2023-1002206 netlink: prevent potential spectre v1 gadgets

netlink: prevent potential spectre v1 gadgets This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.231 by commit...

GSD-2023-1002204 ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()

ipv4: prevent potential spectre v1 gadget in ipmetricsconvert This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.231 by commit...

GSD-2023-1002203 ipv4: prevent potential spectre v1 gadget in fib_metrics_match()

ipv4: prevent potential spectre v1 gadget in fibmetricsmatch This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.231 by commit...

GSD-2023-1002143 netlink: prevent potential spectre v1 gadgets

netlink: prevent potential spectre v1 gadgets This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.166 by commit...