Archive
July 2023
Vulnerabilities first published in this month (UTC), newest first.
2,318 results · Feed
-
Unscored —
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariabl…
-
Unscored —
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function BackwardPass::IsEmpt…
-
High 7.5
goproxy Denial of Service vulnerability
goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.
-
Unscored —
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::…
-
Unscored —
An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, whic…
-
Unscored —
Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and mat4_read_heade…
-
Unscored —
Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspeci…
-
Unscored —
An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to …
-
Medium —
libostree vulnerable to denial of service attack
An issue was discovered in ostree before 2022.7 allows attackers to cause a denial of service or other unspecified impacts via the print_panic function in repo_checkout_filter.rs.
-
Unscored —
An issue was discovered on atasm, version 1.09. A stack-buffer-overflow vulnerability in function aprintf() in asm.c al…
-
Unscored —
An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memo…
-
Unscored —
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible c…
-
Unscored —
In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cau…
-
Unscored —
An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle…
-
Unscored —
SQL injection vulnerability in HKing2802 Locke-Bot 2.0.2 allows remote attackers to run arbitrary SQL commands via craf…
-
Medium 5.3
Improper sanitization of MXCSR and RFLAGS in OpenEnclave
Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environments, also known as Enclaves. There are two issues that are mitigated in version 0.19.3. First, Open Enclave SDK does not…
-
Critical 9.1
TLS 1.3 client issue handling malicious server when not including a KSE and PSK extension
If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying Material) value when generating the session master secret…
-
Medium 5.5
Zip slip in OpenRefine
OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnera…
-
Critical 9.8CVE-2023-37265 Scanner template
Incorrect identification of source IP addresses in CasaOS
CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in …
-
Critical 9.8CVE-2023-37266 Scanner template
Weak json web token (JWT) secrets in CasaOS
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving th…
-
Medium 5.6
Path traversal in metersphere
Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which may cause metersphere to attempt to overwrite an existing file in the defined location or to create a …
-
Low —
topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all
### Summary https://github.com/advisories/GHSA-mc8h-8q98-g5hr https://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead `tempfile` v0.4.26 ships with affected `remove_dir_all` v0.5.3 and so blocks my deployment of v12 to ope…
-
High 8.0
A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions…
-
Medium 6.5
A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series fi…
-
High 8.8
A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions …
-
High 8.0
A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 thro…
-
High 8.8CVE-2023-33012 Public exploit
A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.…
-
High 8.8
A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firm…
-
High 8.8
The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through…
-
High 7.5
Attacker-controlled parameter can cause denial of service in hamba avro
Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com/hamba/avro/v2.Unmarshal()` can throw a `fatal error: runtime: out of memory` which is unrecoverable…
-
Medium 4.3
Server crash via a specially crafted markdown input
Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input.
-
High 8.1
Lack of server certificate validation in websockets connection
Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection.
-
Medium 4.3
Denial of Service via specially crafted gif image
Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsive for an extended period of time by linking to specially crafted image file.
-
Low 3.5
Guest accounts invited and added to channels by Welcomebot plugin
Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default.
-
Medium 4.8
Lack of previous password reset tokens on new token creation
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
-
Low 3.1
Deleted attachments in Boards remain accessible
Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.
-
Low 2.7
Inconsistent state in UI after boards permission change by system admin
Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions.
-
Medium 4.2
Disabling publicly-shared boards does not disable existing publicly available board links
Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessible.
-
Medium 4.3
channel DoS by sharing a boards link
Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.
-
Low 3.1
Member can create team with team override scheme
Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override schem…