‼ CVE-2023-5223 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, has been found in HimitZH HOJ up to 4.6-9a65e3f. This issue affects some unknown processing of the component Topic Handler. The manipulation leads to sandbox issue. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240365 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5197 ‼
📖 Read
via "National Vulnerability Database".
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free.We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0833 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41308 ‼
📖 Read
via "National Vulnerability Database".
Screenshot vulnerability in the input module. Successful exploitation of this vulnerability may affect confidentiality.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39347 ‼
📖 Read
via "National Vulnerability Database".
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can cause Cilium to apply incorrect network policies. This issue arises due to the fact that on pod update, Cilium incorrectly uses user-provided pod labels to select the policies which apply to the workload in question. This can affect Cilium network policies that use the namespace, service account or cluster constructs to restrict traffic, Cilium clusterwide network policies that use Cilium namespace labels to select the Pod and Kubernetes network policies. Non-existent construct names can be provided, which bypass all network policies applicable to the construct. For example, providing a pod with a non-existent namespace as the value of the `io.kubernetes.pod.namespace` label results in none of the namespaced CiliumNetworkPolicies applying to the pod in question. This attack requires the attacker to have Kubernetes API Server access, as described in the Cilium Threat Model. This issue has been resolved in: Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users are advised to upgrade. As a workaround an admission webhook can be used to prevent pod label updates to the `k8s:io.kubernetes.pod.namespace` and `io.cilium.k8s.policy.*` keys.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-35984 ‼
📖 Read
via "National Vulnerability Database".
The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An attacker in physical proximity can cause a limited out of bounds write.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41312 ‼
📖 Read
via "National Vulnerability Database".
Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause several apps to be activated automatically.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40427 ‼
📖 Read
via "National Vulnerability Database".
The issue was addressed with improved handling of caches. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to read sensitive location information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41326 ‼
📖 Read
via "National Vulnerability Database".
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to alter any user field, and end-up with stealing its account. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5183 ‼
📖 Read
via "National Vulnerability Database".
Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the network_traffic API endpoint. An attacker can leverage this vulnerability to execute code in the context of the PCE’s operating system user.  📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40399 ‼
📖 Read
via "National Vulnerability Database".
The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to disclose kernel memory.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44022 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4506 ‼
📖 Read
via "National Vulnerability Database".
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44020 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5221 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical has been found in ForU CMS. This affects an unknown part of the file /install/index.php. The manipulation of the argument db_name leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-240363. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40384 ‼
📖 Read
via "National Vulnerability Database".
A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to read sensitive location information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39375 ‼
📖 Read
via "National Vulnerability Database".
SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43263 ‼
📖 Read
via "National Vulnerability Database".
A Cross-site scripting (XSS) vulnerability in Froala Editor v.4.1.1 allows attackers to execute arbitrary code via the Markdown component.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41232 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.7, iOS 17 and iPadOS 17, macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. An app may be able to disclose kernel memory.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44017 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39233 ‼
📖 Read
via "National Vulnerability Database".
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may disclose sensitive information.📖 Read
via "National Vulnerability Database".