CVE-2023-28xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
880 records · Page 4 of 9
Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no
UpdatedNextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This allows to see meta information like sharer, sharees and activity of files. It is recommended that the Nextcloud Android a
UpdatedNextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app (richdocuments) is upgraded to 8.0.0-beta.1, 7.0.2 or 6.3.2. Users unable to upgrade may mitigate the issu
Updated- CVE-2023-28644: Reference fetch can saturate the server bandwidth for 10 seconds in nextcloud server 5.7 Medium
Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the Nextcloud Server is upgraded to 25.0.3. There are no known workarounds for this vulnerability.
Updated - CVE-2023-28643: Potential share collision for recipients when caching is enabled in nextcloud server 5.5 Medium
Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being renamed to `{name} (2)`. It is recommended that the Nextcloud Server is upgraded to 25.0.3 or 24.0.9. Users unable to upgrade should avoid sharing 2 folders with the
Updated runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using
UpdatedApiman is a flexible and open source API Management platform. Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL, which includes Organisation ID, Client ID, and Client Version of the targeted non-permitted resource. While not trivial to exploit, it could
UpdatedGLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7.
UpdatedSnappier is a high performance C# implementation of the Snappy compression algorithm. This is a buffer overrun vulnerability that can affect any user of Snappier 1.1.0. In this release, much of the code was rewritten to use byte references rather than pointers to pinned buffers. This change generally improves performance and reduces workload on the garbage collector. However, when the garbage coll
Updated- CVE-2023-28637: DataEase AWS redshift data source exists for remote code execution vulnerability 8.0 High
DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may lead to remote code execution. This vulnerability has been fixed in v1.18.5. Users are advised to upgrade. There are no known workarounds for this vul
Updated GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7.
Updatedvantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names. One example where this is a risk, is when users define which users are allowed to run algorithms on their node. This may be defined by username or user id. Now, for example, if user id
UpdatedGLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the Super-Admin account, resulting in a Privilege Escalation. Versions 9.5.13 and 10.0.7 contain a patch for
UpdatedGLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
UpdatedGLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch f
Updatedcomrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A Comrak AST can be constructed manually by a program instead of parsing a Markdown document with `parse_document`. This AST can then be converted to HTML via `html::format_document_with_plugins`. However, the HTML formatting code assumes that the AST is well-formed. For example, many AST notes contain `[u8]` fie
UpdatedGoCD is an open source continuous delivery server. In GoCD versions from 20.5.0 and below 23.1.0, if the server environment is not correctly configured by administrators to provide access to the relevant PostgreSQL or MySQL backup tools, the credentials for database access may be unintentionally leaked to admin alerts on the GoCD user interface. The vulnerability is triggered only if the GoCD serv
UpdatedGoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that has permissions to configure GoCD pipelines could include JavaScript elements within the label template,
Updatedlambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in question doesn't handle the backslash (`\`) character in the username correctly, leading to a wrong output
Updatedpymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no
Updatedcomrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown. This issue has been addressed in version 0.17.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tr
Updatedmod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an
Updated- CVE-2023-28623: Unauthorized user can register an account in specific configurations in Zulip 6.5 Medium
Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication backend (any aside of `ZulipLDAPAuthBackend` and `EmailAuthBackend`) are the only ones enabled in `AUTHENTICATION_BACKENDS` in `/etc/zulip/settings.py` and 2: The organization permissions don't require invitations to join. An attacker can cre
Updated Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Trident Technolabs Easy Slider Revolution plugin <= 1.0.0 versions.
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wishfulthemes Raise Mag, Wishfulthemes Wishful Blog themes allows Reflected XSS.This issue affects Raise Mag: from n/a through 1.0.7; Wishful Blog: from n/a through 2.0.1.
Updated- CVE-2023-28620: WordPress Cyberus Key Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS) 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cyberus Labs Cyberus Key plugin <= 1.0 versions.
Updated Missing Authorization vulnerability in bnayawpguy Resoto allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Resoto: from n/a through 1.0.8.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions.
Updatedorg-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.
UpdatedAn issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends these logs to the Syslog component.
UpdatedFreewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page.
UpdatedAn issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, and Exynos Modem 5300. An integer overflow in IPv4 fragment handling can occur due to insufficient parameter validation when reassembling these fragments.
UpdatedIncorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended access restrictions.
UpdatedThe update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update image. This allows a remote attacker to gain root access to the system.
Updated- CVE-2023-28609: api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication. 9.8 Critical
api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication.
Updated js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.
Updated- CVE-2023-28606: js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips. 6.1 Medium
js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips.
Updated The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {content} use cases that may be edge cases.
UpdatedZoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.
UpdatedZoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade Zoom Client components to previous versions.
UpdatedZoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. A malicious user may alter protected Zoom Client memory buffer potentially causing integrity issues within the Zoom Client.
UpdatedZoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files potentially causing a loss of integrity and availability to the Zoom Client.
UpdatedZoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victim to a malicious website during meeting creation.
UpdatedZoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash.
UpdatedZoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables
UpdatedZoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to privileges to root.
UpdatedTransient DOS in Bluetooth Host while rfc slot allocation.
UpdatedMemory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
UpdatedInformation disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
UpdatedMemory corruption while loading an ELF segment in TEE Kernel.
UpdatedTransient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).
UpdatedMemory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.
UpdatedMemory corruption in Data Modem while verifying hello-verify message during the DTLS handshake.
Updated- CVE-2023-28581: Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Firmware 9.8 Critical
Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.
Updated Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.
UpdatedMemory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.
UpdatedMemory corruption in Core Services while executing the command for removing a single event listener.
UpdatedIn the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.
Updated- CVE-2023-28576: Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Kernel Driver 6.4 Medium
The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to out-of-bounds read/write issues.
Updated The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
Updated- CVE-2023-28574: Improper Input Validation in Core 9.0 Critical
Memory corruption in core services when Diag handler receives a command to configure event listeners.
Updated Memory corruption in WLAN HAL while parsing WMI command parameters.
UpdatedMemory corruption in WLAN HOST while processing the WLAN scan descriptor list.
UpdatedInformation disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
UpdatedMemory corruption while processing audio effects.
Updated- CVE-2023-28569: Buffer Over-read in WLAN HAL 6.1 Medium
Information disclosure in WLAN HAL while handling command through WMI interfaces.
Updated - CVE-2023-28568: Buffer Over-read in WLAN HAL 6.1 Medium
Information disclosure in WLAN HAL when reception status handler is called.
Updated Memory corruption in WLAN HAL while handling command through WMI interfaces.
Updated- CVE-2023-28566: Buffer Over-read in WLAN HAL 6.1 Medium
Information disclosure in WLAN HAL while handling the WMI state info command.
Updated Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
UpdatedMemory corruption in WLAN HAL while passing command parameters through WMI interfaces.
UpdatedInformation disclosure in IOE Firmware while handling WMI command.
UpdatedMemory corruption while handling payloads from remote ESL.
UpdatedMemory corruption in QESL while processing payload from external ESL device to firmware.
UpdatedMemory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
UpdatedMemory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
UpdatedMemory corruption in WLAN handler while processing PhyID in Tx status handler.
UpdatedMemory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
UpdatedCryptographic issue in HLOS during key management.
UpdatedTransient DOS in Audio while remapping channel buffer in media codec decoding.
UpdatedInformation Disclosure in Qualcomm IPC while reading values from shared memory in VM.
UpdatedInformation Disclosure in WLAN Host when processing WMI event command.
Updated- CVE-2023-28551: Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS 7.8 High
Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
Updated Memory corruption in MPP performance while accessing DSM watermark using external memory address.
Updated- CVE-2023-28549: Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN HAL 7.8 High
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
Updated Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.
UpdatedMemory corruption in SPS Application while requesting for public key in sorter TA.
UpdatedMemory Corruption in SPS Application while exporting public key in sorter TA.
UpdatedMemory corruption in TZ Secure OS while loading an app ELF.
UpdatedMemory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
UpdatedA malformed DLC can trigger Memory Corruption in SNPE library due to out of bounds read, such as by loading an untrusted model (e.g. from a remote source).
UpdatedMemory Corruption in WLAN HOST while fetching TX status information.
UpdatedMemory Corruption in Data Modem while processing DMA buffer release event about CFR data.
UpdatedCryptographic issue in Data Modem due to improper authentication during TLS handshake.
UpdatedMemory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
UpdatedMemory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region.
UpdatedMemory corruption while allocating memory in COmxApeDec module in Audio.
UpdatedMissing Authorization vulnerability in Acato Branded Social Images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Branded Social Images: from n/a through 1.1.0.
UpdatedUnauth. Reflected Cross-Site Scripting (XSS) vulnerability in Paytm Paytm Payment Donation plugin <= 2.2.0 versions.
Updated- CVE-2023-28534: WordPress WP Job Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium
Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board plugin <= 2.0.0 versions.
Updated