Archive
4 December 2023
Vulnerabilities first published on this day (UTC), newest first.
243 results · Feed
-
High 7.6CVE-2023-5808 Public exploit
System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products are susceptible to unintended information disclosure via unprivileged access to HNAS configuration backup and diagnostic data.
SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrative role are able to access HNAS configuration backup and diagnostic data, that would normally be ba…
-
Medium 6.3
Cross-site Scripting in Ajax.NET Professional
Ajax.NET Professional (AjaxPro) is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package are vulnerable cross site scripting attac…
-
Low 3.9
Command substitution output can trigger shell expansion in fish shell
fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command su…
-
Medium 5.3
Malicious parameters can cause a denial of service in lestrrat-go/jwx
lestrrat-go/jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. A p2c parameter set too high in JWE's algorithm PBES2-* could lead to a denial of service. The JWE key management algorithms based on PBKDF2 r…
-
Critical 9.3
Improper Sanitization of Branch Name Leads to Arbitrary Code Injection
tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within …
-
High —
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
### Impact Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest. ### Patches The issue has been pat…
-
Medium 4.9
Possible private key restoration in go package github.com/ecies/go
ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in…
-
High 7.8
Delta Electronics DOPSoft Stack-based Buffer Overflow
Delta Electronics DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can lead a legitimate user to execute a specially crafted file.
-
Medium 6.1CVE-2023-49293 Scanner template
Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite
Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`<script type="module…
-
Medium 4.3
Improper input leads to DoS
Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local area network, resulting in a Denial of Service condition for the captive portal.
-
High 8.1
Use of hardcoded certificate and private key
Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these items could potentially perform a man in the middle attack between the ACEManager client and ACEManager server.
-
High 8.1
Use of Hard-Coded Credentials
When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the common root password for that version in a directory accessible to a user with root privileges or equivalent access.
-
High 8.6CVE-2023-49285 EPSS 88%
Denial of Service in HTTP Message Processing in Squid
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgr…
-
High 7.5
Improper input leads to DoS
The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager recovers fr…
-
High 8.6CVE-2023-49286 EPSS 10%
Denial of Service in Helper Process management
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5.…
-
High 8.1
Cross-site scripting vulnerability in ACEManager
The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file upload field which does not fully validate the file name, creating a Stored Cross-Site Scripting condition.
-
High 7.1
Improper input leads to DoS
The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authenticated user to perform client-side script execution within ACEManager, altering the device functionality until the devi…
-
High 8.6
Denial of Service in HTTP Collapsed Forwarding in Squid
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and includ…
-
High 7.5CVE-2023-40459 Public exploit
Improper input leads to DoS
The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager …
-
Unscored —
In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to…
-
Unscored —CVE-2023-45779 Public exploit
In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly use…
-
Unscored —
In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check. This …
-
Unscored —
In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check. This …
-
Unscored —CVE-2023-45777 Public exploit
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activitie…
-
Unscored —
In fixUpIncomingShortcutInfo of ShortcutService.java, there is a possible way to view another user's image due to a con…
-
Unscored —
In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a missing bounds check. This co…
-
Unscored —
In mOnDone of NotificationConversationInfo.java, there is a possible way to access app notification data of another use…
-
Unscored —
In OpRecordAudioMonitor::onFirstRef of AudioRecordClient.cpp, there is a possible way to record audio from the backgrou…
-
Unscored —
In multiple locations, there is a possible way to corrupt memory due to a double free. This could lead to local escalat…
-
Unscored —
In hasPermissionForActivity of PackageManagerHelper.java, there is a possible URI grant due to improper input validatio…
-
Unscored —
In onTransact of IncidentService.cpp, there is a possible out of bounds write due to memory corruption. This could lead…
-
Unscored —
In createDontSendToRestrictedAppsBundle of PendingIntentUtils.java, there is a possible background activity launch due …
-
Unscored —
In BTM_BleVerifySignature of btm_ble.cc, there is a possible way to bypass signature validation due to side channel inf…
-
Unscored —
In verifyShortcutInfoPackage of ShortcutService.java, there is a possible way to see another user's image due to a conf…
-
Unscored —
In keyguardGoingAway of ActivityTaskManagerService.java, there is a possible lock screen bypass due to a missing permis…
-
High 8.8
In callback_thread_event of com_android_bluetooth_btservice_AdapterService.cpp, there is a possible memory corruption d…
-
Unscored —
In transcodeQ*ToFloat of btif_avrcp_audio_track.cc, there is a possible out of bounds write due to a missing bounds che…
-
Unscored —CVE-2023-40084 Public exploit
In run of MDnsSdListener.cpp, there is a possible memory corruption due to a use after free. This could lead to local e…
-
Unscored —
In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to…
-
Unscored —
In getCredentialManagerPolicy of DevicePolicyManagerService.java, there is a possible method for users to select creden…