Archive
30 October 2023
Vulnerabilities first published on this day (UTC), newest first.
171 results · Feed
-
Medium 5.0
KernelSU signature validation mismatch
KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a malware whose app signing block specially constructed, it can take over root privileges on the device…
-
Low 3.7
JumpServer default admin user email leak password reset
JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is `admin[@]mycompany[.]com`, and users reset their passwords by sending an …
-
High 7.5
xkeys Seal encryption used fixed key for all encryption
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authe…
-
High 7.5
Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`
Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can…
-
Medium 4.7CVE-2023-45671 Scanner template
Frigate reflected XSS through `/<camera_name>` API endpoints
Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/<camera_name>` base path as values provided for the path are not sanitized. Exploit…
-
High 7.5
Frigate cross-site request forgery in `config_save` and `config_set` request handlers
Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the `config/save` and `config/set` endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the config…
-
High 7.5
CloudExplorer Lite permission bypass vulnerability
CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with `matching/API/`, which can cause a permission bypass. Version 1.4.1 contain…
-
Medium 5.6
BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)
BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). This issue is a bypass of CVE-2023-33176. A patch in versions 2.6.12 and 2.7.0-rc.1 disabled follow r…
-
Medium 6.3
BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. …
-
Medium 5.3
Draw while calling getdrawinfo()
A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion.
-
Medium 5.3
baserCMS Code Injection Vulnerability in Mail Form Feature
baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baserCMS. As of time of publication, no known patched versions are available.
-
Medium 4.7
baserCMS CSRF vulnerability in Content preview Feature
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.
-
Medium 4.9
baserCMS Directory Traversal vulnerability in Form submission data management Feature
baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. Version 4.8.0 contains a patch for this issue.
-
Medium 6.1
baserCMS Cross-site Scripting vulnerability in File upload Feature
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload feature of baserCMS. Version 4.8.0 contains a patch for this issue.
-
Low 3.1
BigBlueButton Path Traversal – Reading Certain File Extensions
BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with a valid starting folder path, to traverse and read other files without authentication, assuming the …
-
Medium 5.3
BigBlueButton Unrestricted File Upload vulnerability
BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove …
-
Low 3.5
FlyteAdmin SQL Injection in List Filters
FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL s…
-
High 7.3
In Print Service, there is a possible background activity launch due to a logic error in the code. This could lead to l…
-
Unscored —
In collapse of canonicalize_md.c, there is a possible out of bounds read due to a missing bounds check. This could lead…
-
Unscored —
In sdksandbox, there is a possible strandhogg style overlay attack due to a logic error in the code. This could lead to…
-
Unscored —
In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to lo…
-
Unscored —
In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead t…
-
Unscored —
In Settings, there is a possible way for the user to change SIM due to a missing permission check. This could lead to l…
-
Unscored —
In Messaging, there is a possible way to disable the messaging application due to improper input validation. This could…
-
Unscored —
In Bluetooth, there is a possible out of bounds read due to a use after free. This could lead to remote information dis…
-
Unscored —
In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from another user due to a…
-
Unscored —
In Bluetooth, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of…
-
Unscored —
In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log infor…
-
Unscored —
In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lea…
-
Unscored —
In Whitechapel, there is a possible out of bounds read due to memory corruption. This could lead to local information d…
-
High 7.8
In Sim, there is a possible way to evade mobile preference restrictions due to a permission bypass. This could lead to …
-
Unscored —
In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalat…
-
Unscored —
In Media Resource Manager, there is a possible local arbitrary code execution due to use after free. This could lead to…
-
Unscored —
In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent. This could lead to …
-
Unscored —
In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalatio…
-
Unscored —
In Content Resolver, there is a possible method to access metadata about existing content providers on the device due t…
-
Unscored —
In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt. This cou…
-
Unscored —
In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local informatio…
-
Unscored —
In SELinux Policy, there is a possible restriction bypass due to a permissions bypass. This could lead to local informa…
-
Medium 5.5
In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This could lead to local …