‼ CVE-2023-26495 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Open Design Alliance Drawings SDK before 2024.1. A crafted DWG file can force the SDK to reuse an object that has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28093 ‼
📖 Read
via "National Vulnerability Database".
A user with a compromised configuration can start an unsigned binary as a service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26773 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting vulnerability found in Sales Tracker Management System v.1.0 allows a remote attacker to gain privileges via the product list function in the Master.php file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26065 ‼
📖 Read
via "National Vulnerability Database".
Certain Lexmark devices through 2023-02-19 have an Integer Overflow.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26063 ‼
📖 Read
via "National Vulnerability Database".
Certain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26069 ‼
📖 Read
via "National Vulnerability Database".
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 3 of 4).📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-29192 ‼
📖 Read
via "National Vulnerability Database".
SilverwareGames.io versions before 1.2.19 allow users with access to the game upload panel to edit download links for games uploaded by other developers. This has been fixed in version 1.2.19.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1668 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24721 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26467 ‼
📖 Read
via "National Vulnerability Database".
A man in the middle can redirect traffic to a malicious server in a compromised configuration.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1916 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.📖 Read
via "National Vulnerability Database".
🕴 Renewed Focus on Incident Response Brings New Competitors and Partnerships 🕴
📖 Read
via "Dark Reading".
Microsoft and others are doubling down on incident response, adding services and integrating programs to make security analysts and IR engagements more efficient.📖 Read
via "Dark Reading".
Dark Reading
Renewed Focus on Incident Response Brings New Competitors and Partnerships
Microsoft and others are doubling down on incident response, adding services and integrating programs to make security analysts and incident response engagements more efficient.
‼ CVE-2023-1903 ‼
📖 Read
via "National Vulnerability Database".
SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header data.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29112 ‼
📖 Read
via "National Vulnerability Database".
The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29108 ‼
📖 Read
via "National Vulnerability Database".
The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29111 ‼
📖 Read
via "National Vulnerability Database".
The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a result, an attacker can cause a low impact on the confidentiality of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29186 ‼
📖 Read
via "National Vulnerability Database".
In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28765 ‼
📖 Read
via "National Vulnerability Database".
An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27897 ‼
📖 Read
via "National Vulnerability Database".
In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can can have limited impact on confidentiality and integrity of non-critical user or application data and application availability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27267 ‼
📖 Read
via "National Vulnerability Database".
Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27497 ‼
📖 Read
via "National Vulnerability Database".
Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.📖 Read
via "National Vulnerability Database".