Archive
June 2023
Vulnerabilities first published in this month (UTC), newest first.
2,424 results · Feed
-
Unscored —
In requestAppKeyboardShortcuts of WindowManagerService.java, there is a possible way to infer the app a user is interac…
-
Unscored —
In cd_CodeMsg of cd_codec.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to …
-
Unscored —
In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This c…
-
Unscored —
In addGroupWithConfigInternal of p2p_iface.cpp, there is a possible out of bounds read due to unsafe deserialization. T…
-
Unscored —CVE-2023-21173 Public exploit
In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due t…
-
Medium 6.2CVE-2023-21237 Exploited
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification…
KEV Mar 5, 2024 -
Unscored —
In encode of wlandata.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to lo…
-
Unscored —
In initiateVenueUrlAnqpQueryInternal of sta_iface.cpp, there is a possible out of bounds read due to unsafe deserializa…
-
Unscored —
In btm_ble_update_inq_result of btm_ble_gap.cc, there is a possible out of bounds read due to a heap buffer overflow. T…
-
Unscored —
In aoc_service_set_read_blocked of aoc.c, there is a possible out of bounds write due to a missing bounds check. This c…
-
Unscored —
D-Link DIR-823G firmware version 1.02B05 has a password reset vulnerability, which originates from the SetMultipleActio…
-
High 8.6
A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Sof…
-
Critical 9.6
A vulnerability in the change password functionality of Cisco Expressway Series and Cisco TelePresence Video Communicat…
-
Medium 6.1
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager,…
-
Medium 4.8
A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Bu…
-
High 7.5
A vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service…
-
Medium 5.4
Cisco Secure Email Gateway, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Secu…
-
High 7.8CVE-2023-20178 Public exploit
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco …
-
Medium 6.8
A vulnerability in the Administrative XML Web Service (AXL) API of Cisco Unified Communications Manager (Unified CM) an…
-
Medium 5.4
Cisco Secure Email Gateway, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Secu…
-
Medium 4.3
A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileg…
-
Medium 6.2
Cisco Duo Two-Factor Authentication for macOS Authentication Bypass Vulnerability
A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to bypass secondary authentication and access an affected macOS device. This vulnerability is due to the incorrect handling of responses from Cisc…
-
Critical 9.6
Cisco Expressway Series and Cisco TelePresence Video Communication Server Privilege Escalation Vulnerabilities
Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated attacker with Administrator-level read-only credentials to elevate their privileges to Administrator with read-write crede…
-
Medium 6.4
An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4…
-
Unscored —CVE-2022-44276 Public exploit
In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.
-
Unscored —
In hasInputInfo of Layer.cpp, there is a possible bypass of user interaction requirements due to a tapjacking/overlay a…
-
Unscored —
Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-addre…
-
Unscored —
Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to …
-
Medium 6.2
Infinite Loop when a comment isn't followed by a character in pypdf
pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue w…
-
Low 3.3
Deadlock in Xpdf 4.04 due to PDF object stream references
Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream.
-
Medium 5.3
Cross site scripting (XSS) in meldekarten generator
Meldekarten generator is an open source project to create a program, running locally in the browser without the need for an internet-connection, to create, store and print registration cards for volunteers. All text fields on the webpage are vulnerable to XSS…
-
Medium 6.8
IBM Cloud Pak for Security information disclosure
IBM Cloud Pak for Security (CP4S) 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to access data from another tenant's account. IBM X-Force ID: 254136.
-
Medium 5.1
IBM Robotic Process Automation for Cloud Pak access control
IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to insufficient security configuration which may allow creation of namespaces within a cluster. IBM X-Force ID: 244500.
-
Medium 4.0
IBM Robotic Process Automation for Cloud Pak security configuration
IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to security misconfiguration of the Redis container which may provide elevated privileges. IBM X-Force ID: 244074.
-
Medium 6.5
IBM QRadar information disclosure
IBM QRadar SIEM 7.5.0 is vulnerable to information exposure allowing a delegated Admin tenant user with a specific domain security profile assigned to see data from other domains. IBM X-Force ID: 230403.
-
Medium 4.6
IBM QRadar cross-site scripting
IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM …
-
Medium 4.0
LDAP password leak in Apereo CAS - GHSL-2023-009
Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certificates. These certificates can be provided via TLS handshake or a special HTTP header, such as “ssl_cl…
-
Medium 5.9
IBM QRadar information disclosure
IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 248147.
-
Medium 4.3
IBM QRadar security bypass
IBM QRadar SIEM 7.5.0 could allow an authenticated user to perform unauthorized actions due to hazardous input validation. IBM X-Force ID: 248134.
-
Medium 6.1
IBM Business Automation Workflow cross-site scripting
IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted se…