Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 48 are already weaponised in the wild.
The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.
Security update for chromium
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | SUSE:Package Hub 15 SP4 | chromium | — |
| chromium | affected | SUSE:Package Hub 15 SP5 | chromium | — |
| chromium | affected | openSUSE:Leap 15.4 | chromium | — |
| chromium | affected | openSUSE:Leap 15.5 | chromium | — |
Security update for chromium
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | SUSE:Package Hub 15 SP4 | chromium | — |
| chromium | affected | SUSE:Package Hub 15 SP5 | chromium | — |
| chromium | affected | openSUSE:Leap 15.4 | chromium | — |
| chromium | affected | openSUSE:Leap 15.5 | chromium | — |
libwebp: OOB write in BuildHuffmanTable
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chai2010/webp | affected | github.com | github.com/chai2010/webp | — |
| chai2010/webp | affected | github.com | github.com/chai2010/webp | — |
| electron | affected | npm | electron | — |
| firefox-esr | affected | chainguard | firefox-esr | — |
| github.com/chai2010/webp | affected | Go | github.com/chai2010/webp | — |
| libwebp | affected | wolfi | libwebp | — |
| libwebp | affected | chainguard | libwebp | — |
| libwebp | affected | webmproject | — | — |
| libwebp-sys | affected | crates.io | libwebp-sys | — |
| libwebp-sys2 | affected | crates.io | libwebp-sys2 | — |
| magick.net-q16-anycpu | affected | NuGet | magick.net-q16-anycpu | — |
| magick.net-q16-anycpu | affected | NuGet | magick.net-q16-anycpu | — |
| magick.net-q16-hdri-anycpu | affected | NuGet | magick.net-q16-hdri-anycpu | — |
| magick.net-q16-hdri-anycpu | affected | NuGet | magick.net-q16-hdri-anycpu | — |
| magick.net-q16-x64 | affected | NuGet | magick.net-q16-x64 | — |
| magick.net-q16-x64 | affected | NuGet | magick.net-q16-x64 | — |
| magick.net-q8-anycpu | affected | NuGet | magick.net-q8-anycpu | — |
| magick.net-q8-anycpu | affected | NuGet | magick.net-q8-anycpu | — |
| magick.net-q8-openmp-x64 | affected | NuGet | magick.net-q8-openmp-x64 | — |
| magick.net-q8-openmp-x64 | affected | NuGet | magick.net-q8-openmp-x64 | — |
| magick.net-q8-x64 | affected | NuGet | magick.net-q8-x64 | — |
| magick.net-q8-x64 | affected | NuGet | magick.net-q8-x64 | — |
| pillow | affected | PyPI | pillow | — |
| Pillow | affected | PyPI | Pillow | — |
| Pillow | affected | PyPI | Pillow | — |
| SkiaSharp | affected | NuGet | SkiaSharp | — |
| SkiaSharp | affected | NuGet | SkiaSharp | — |
| webp | affected | crates.io | webp | — |
libwebp: OOB write in BuildHuffmanTable
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chai2010/webp | affected | github.com | github.com/chai2010/webp | — |
| electron | affected | npm | electron | — |
| libwebp-sys | affected | crates.io | libwebp-sys | — |
| libwebp-sys2 | affected | crates.io | libwebp-sys2 | — |
| magick.net-q16-anycpu | affected | NuGet | magick.net-q16-anycpu | — |
| magick.net-q16-anycpu | affected | NuGet | magick.net-q16-anycpu | — |
| magick.net-q16-hdri-anycpu | affected | NuGet | magick.net-q16-hdri-anycpu | — |
| magick.net-q16-hdri-anycpu | affected | NuGet | magick.net-q16-hdri-anycpu | — |
| magick.net-q16-x64 | affected | NuGet | magick.net-q16-x64 | — |
| magick.net-q16-x64 | affected | NuGet | magick.net-q16-x64 | — |
| magick.net-q8-anycpu | affected | NuGet | magick.net-q8-anycpu | — |
| magick.net-q8-anycpu | affected | NuGet | magick.net-q8-anycpu | — |
| magick.net-q8-openmp-x64 | affected | NuGet | magick.net-q8-openmp-x64 | — |
| magick.net-q8-openmp-x64 | affected | NuGet | magick.net-q8-openmp-x64 | — |
| magick.net-q8-x64 | affected | NuGet | magick.net-q8-x64 | — |
| magick.net-q8-x64 | affected | NuGet | magick.net-q8-x64 | — |
| pillow | affected | PyPI | pillow | — |
| SkiaSharp | affected | NuGet | SkiaSharp | — |
| SkiaSharp | affected | NuGet | SkiaSharp | — |
| webp | affected | crates.io | webp | — |
DEBIAN-CVE-2023-4863
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
| firefox-esr | affected | Debian:11 | firefox-esr | — |
| firefox-esr | affected | Debian:12 | firefox-esr | — |
| firefox-esr | affected | Debian:13 | firefox-esr | — |
| firefox-esr | affected | Debian:14 | firefox-esr | — |
| libwebp | affected | Debian:11 | libwebp | — |
| libwebp | affected | Debian:12 | libwebp | — |
| libwebp | affected | Debian:13 | libwebp | — |
| libwebp | affected | Debian:14 | libwebp | — |
| thunderbird | affected | Debian:11 | thunderbird | — |
| thunderbird | affected | Debian:12 | thunderbird | — |
| thunderbird | affected | Debian:13 | thunderbird | — |
| thunderbird | affected | Debian:14 | thunderbird | — |
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
CVEs:CVE-2023-4863
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| active_iq_unified_manager | affected | netapp | — | — |
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| edge_chromium | affected | microsoft | — | — |
| fedora | affected | fedoraproject | — | — |
| firefox | affected | mozilla | — | — |
| honeyview | affected | bandisoft | — | — |
| libwebp | affected | webmproject | — | — |
| seequent_leapfrog | affected | bentley | — | — |
| teams | affected | microsoft | — | — |
| thunderbird | affected | mozilla | — | — |
| webp_image_extension | affected | microsoft | — | — |
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
CVEs:CVE-2023-4863
libwebp: OOB write in BuildHuffmanTable
CVEs:CVE-2023-4863
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chai2010/webp | affected | github.com | github.com/chai2010/webp | — |
| electron | affected | npm | electron | — |
| libwebp-sys | affected | crates.io | libwebp-sys | — |
| libwebp-sys2 | affected | crates.io | libwebp-sys2 | — |
| magick.net-q16-anycpu | affected | NuGet | magick.net-q16-anycpu | — |
| magick.net-q16-hdri-anycpu | affected | NuGet | magick.net-q16-hdri-anycpu | — |
| magick.net-q16-x64 | affected | NuGet | magick.net-q16-x64 | — |
| magick.net-q8-anycpu | affected | NuGet | magick.net-q8-anycpu | — |
| magick.net-q8-openmp-x64 | affected | NuGet | magick.net-q8-openmp-x64 | — |
| magick.net-q8-x64 | affected | NuGet | magick.net-q8-x64 | — |
| pillow | affected | PyPI | pillow | — |
| SkiaSharp | affected | NuGet | SkiaSharp | — |
| webp | affected | crates.io | webp | — |
libwebp: OOB write in BuildHuffmanTable
CVEs:CVE-2023-4863
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chai2010/webp | affected | github.com | github.com/chai2010/webp | — |
| electron | affected | npm | electron | — |
| libwebp-sys | affected | crates.io | libwebp-sys | — |
| libwebp-sys2 | affected | crates.io | libwebp-sys2 | — |
| magick.net-q16-anycpu | affected | NuGet | magick.net-q16-anycpu | — |
| magick.net-q16-hdri-anycpu | affected | NuGet | magick.net-q16-hdri-anycpu | — |
| magick.net-q16-x64 | affected | NuGet | magick.net-q16-x64 | — |
| magick.net-q8-anycpu | affected | NuGet | magick.net-q8-anycpu | — |
| magick.net-q8-openmp-x64 | affected | NuGet | magick.net-q8-openmp-x64 | — |
| magick.net-q8-x64 | affected | NuGet | magick.net-q8-x64 | — |
| pillow | affected | PyPI | pillow | — |
| SkiaSharp | affected | NuGet | SkiaSharp | — |
| webp | affected | crates.io | webp | — |
Security update for chromium
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | openSUSE:Leap 15.5 | chromium | — |
| chromium | affected | SUSE:Package Hub 15 SP4 | chromium | — |
| chromium | affected | SUSE:Package Hub 15 SP5 | chromium | — |
| chromium | affected | openSUSE:Leap 15.4 | chromium | — |
chromium - security update
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:11 | chromium | — |
DEBIAN-CVE-2023-5217
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:14 | chromium | — |
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| firefox-esr | affected | Debian:14 | firefox-esr | — |
| firefox-esr | affected | Debian:11 | firefox-esr | — |
| firefox-esr | affected | Debian:12 | firefox-esr | — |
| firefox-esr | affected | Debian:13 | firefox-esr | — |
| libvpx | affected | Debian:11 | libvpx | — |
| libvpx | affected | Debian:12 | libvpx | — |
| libvpx | affected | Debian:13 | libvpx | — |
| libvpx | affected | Debian:14 | libvpx | — |
| thunderbird | affected | Debian:11 | thunderbird | — |
| thunderbird | affected | Debian:12 | thunderbird | — |
| thunderbird | affected | Debian:13 | thunderbird | — |
| thunderbird | affected | Debian:14 | thunderbird | — |
Electron affected by libvpx's heap buffer overflow in vp8 encoding
CVEs:CVE-2023-5217
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| electron | affected | npm | electron | — |
Electron affected by libvpx's heap buffer overflow in vp8 encoding
CVEs:CVE-2023-5217
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| electron | affected | npm | electron | — |
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-5217
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-5217
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| edge | affected | microsoft | — | — |
| edge_chromium | affected | microsoft | — | — |
| enterprise_linux | affected | redhat | — | — |
| fedora | affected | fedoraproject | — | — |
| firefox | affected | mozilla | — | — |
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| libvpx | affected | webmproject | — | — |
| thunderbird | affected | mozilla | — | — |
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted...
CVEs:CVE-2023-41064
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| macos | affected | apple | — | — |
CVEs:CVE-2023-41064
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVEs:CVE-2023-41064
Security update for chromium
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | openSUSE:Leap 15.4 | chromium | — |
| chromium | affected | openSUSE:Leap 15.5 | chromium | — |
| chromium | affected | SUSE:Package Hub 15 SP4 | chromium | — |
| chromium | affected | SUSE:Package Hub 15 SP5 | chromium | — |
chromium - security update
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
DEBIAN-CVE-2023-4762
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-4762
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| edge_chromium | affected | microsoft | — | — |
| fedora | affected | fedoraproject | — | — |
CVEs:CVE-2023-4762
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-4762
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-4762
CVEs:CVE-2023-36802
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
CVEs:CVE-2023-36802
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| windows_10_1809 | affected | microsoft | — | — |
| windows_10_21h2 | affected | microsoft | — | — |
| windows_10_22h2 | affected | microsoft | — | — |
| windows_11_21h2 | affected | microsoft | — | — |
| windows_11_22h2 | affected | microsoft | — | — |
| windows_server_2019 | affected | microsoft | — | — |
| windows_server_2022 | affected | microsoft | — | — |
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
CVEs:CVE-2023-36802
CVEs:CVE-2023-36761
Microsoft Word Information Disclosure Vulnerability
CVEs:CVE-2023-36761
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| 365_apps | affected | microsoft | — | — |
| office | affected | microsoft | — | — |
| office_long_term_servicing_channel | affected | microsoft | — | — |
| word | affected | microsoft | — | — |
Microsoft Word Information Disclosure Vulnerability
CVEs:CVE-2023-36761
[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild
CVEs:CVE-2023-26369
CVEs:CVE-2023-26369
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit...
CVEs:CVE-2023-26369
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| acrobat | affected | adobe | — | — |
| acrobat_dc | affected | adobe | — | — |
| acrobat_reader | affected | adobe | — | — |
| acrobat_reader_dc | affected | adobe | — | — |
CVEs:CVE-2023-41991
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited a...
CVEs:CVE-2023-41991
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| macos | affected | apple | — | — |
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
CVEs:CVE-2023-41991
CVEs:CVE-2023-41061
A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been ...
CVEs:CVE-2023-41061
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| watchos | affected | apple | — | — |
A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVEs:CVE-2023-41061
CVEs:CVE-2023-41992
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been a...
CVEs:CVE-2023-41992
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipados | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
| macos | affected | apple | — | — |
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
CVEs:CVE-2023-41992
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed f...
CVEs:CVE-2023-35674
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVEs:CVE-2023-35674
CVEs:CVE-2023-35674
PUB-A-294605494
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| :unknown: | affected | Android | :unknown: | — |
Updated chromium-browser-stable packages fix security vulnerability
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium-browser-stable | affected | Mageia:9 | chromium-browser-stable | — |
DEBIAN-CVE-2023-4761
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
CVEs:CVE-2023-4761
Out of bounds memory access in FedCM in Google Chrome prior to 116.0.5845.179 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-4761
Out of bounds memory access in FedCM in Google Chrome prior to 116.0.5845.179 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-4761
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
DEBIAN-CVE-2023-4763
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
Use after free in Networks in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-4763
Use after free in Networks in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-4763
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
CVEs:CVE-2023-4763
Security update for chromium
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | SUSE:Package Hub 15 SP4 | chromium | — |
| chromium | affected | SUSE:Package Hub 15 SP5 | chromium | — |
| chromium | affected | openSUSE:Leap 15.4 | chromium | — |
| chromium | affected | openSUSE:Leap 15.5 | chromium | — |
chromium - security update
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
Improper authentication in SecSettings prior to SMR Sep-2023 Release 1 allows attacker to access Captive Portal Wi-Fi in Reactivation Lock status.
CVEs:CVE-2023-30708
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
CVEs:CVE-2023-30708
CVEs:CVE-2023-33914
In NIA0 algorithm in Security Mode Command, there is a possible missing verification incorrect input. This could lead to remote information disclosure no additional execution privileges needed
CVEs:CVE-2023-33914
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-33915
In LTE protocol stack, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed
CVEs:CVE-2023-33915
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-31416
Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment.
CVEs:CVE-2023-31416
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| elastic_cloud_on_kubernetes | affected | elastic | — | — |
CVEs:CVE-2023-30712
Improper input validation in Settings Suggestions prior to SMR Sep-2023 Release 1 allows attackers to launch arbitrary activity.
CVEs:CVE-2023-30712
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
Improper input validation vulnerability in Knox AI prior to SMR Sep-2023 Release 1 allows local attackers to launch privileged activities.
CVEs:CVE-2023-30710
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
CVEs:CVE-2023-30710
CVEs:CVE-2023-30709
Improper access control in Dual Messenger prior to SMR Sep-2023 Release 1 allows local attackers launch activity with system privilege.
CVEs:CVE-2023-30709
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
Improper authentication in Phone and Messaging Storage SMR SEP-2023 Release 1 allows attacker to insert arbitrary data to the provider.
CVEs:CVE-2023-30711
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
CVEs:CVE-2023-30711
CVEs:CVE-2023-30715
Improper access control vulnerability in Weather prior to SMR Sep-2023 Release 1 allows attackers to access location information set in Weather without permission.
CVEs:CVE-2023-30715
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
Sensitive information exposure vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to get unresettable identifiers.
CVEs:CVE-2023-30717
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
CVEs:CVE-2023-30717
CVEs:CVE-2023-30713
Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-2023 Release 1 allows local attackers to change some settings of the folder lock.
CVEs:CVE-2023-30713
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
PendingIntent hijacking in LmsAssemblyTrackerCTC prior to SMR Sep-2023 Release 1 allows local attacker to gain arbitrary file access.
CVEs:CVE-2023-30720
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
CVEs:CVE-2023-30720
CVEs:CVE-2023-44121
The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a...
CVEs:CVE-2023-44121
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-32810
In bluetooth driver, there is a possible out of bounds read due to improper input validation. This could lead to local information leak with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07867212; Is...
CVEs:CVE-2023-32810
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
In bluetooth driver, there is a possible out of bounds read due to improper input validation. This could lead to local information leak with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07867212; Issue ID: ALPS07867212.
CVEs:CVE-2023-32810
CVEs:CVE-2023-32811
CVEs:CVE-2023-32806
In connectivity system driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID...
CVEs:CVE-2023-32811
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| yocto | affected | linuxfoundation | — | — |
In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07441589;...
CVEs:CVE-2023-32806
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| openwrt | affected | openwrt | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-32816
CVEs:CVE-2023-32813
CVEs:CVE-2023-32814
CVEs:CVE-2023-32807
In gnss service, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08044040; ...
CVEs:CVE-2023-32816
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In gnss service, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08031947; ...
CVEs:CVE-2023-32814
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08017370;...
CVEs:CVE-2023-32813
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| openwrt | affected | openwrt | — | — |
| yocto | affected | linuxfoundation | — | — |
In wlan service, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07588360; ...
CVEs:CVE-2023-32807
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| yocto | affected | linuxfoundation | — | — |
CVE-2023-38039 affecting package tensorflow for versions less than 2.16.1-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| tensorflow | affected | Azure Linux:3 | tensorflow | — |
Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| protobuf | affected | SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | protobuf | — |
| python-cryptography | affected | SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | python-cryptography | — |
| python-psutil | affected | SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | python-psutil | — |
| python-requests | affected | SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | python-requests | — |
| python-websocket-client | affected | SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | python-websocket-client | — |
Fix CVE(s): CVE-2022-48565
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| idle-python3.6 | affected | TuxCare:Ubuntu:18.04 | idle-python3.6 | — |
| libpython3.6 | affected | TuxCare:Ubuntu:18.04 | libpython3.6 | — |
| libpython3.6-dev | affected | TuxCare:Ubuntu:18.04 | libpython3.6-dev | — |
| libpython3.6-minimal | affected | TuxCare:Ubuntu:18.04 | libpython3.6-minimal | — |
| libpython3.6-stdlib | affected | TuxCare:Ubuntu:18.04 | libpython3.6-stdlib | — |
| libpython3.6-testsuite | affected | TuxCare:Ubuntu:18.04 | libpython3.6-testsuite | — |
| python3.6 | affected | TuxCare:Ubuntu:18.04 | python3.6 | — |
| python3.6-dev | affected | TuxCare:Ubuntu:18.04 | python3.6-dev | — |
| python3.6-doc | affected | TuxCare:Ubuntu:18.04 | python3.6-doc | — |
| python3.6-examples | affected | TuxCare:Ubuntu:18.04 | python3.6-examples | — |
| python3.6-minimal | affected | TuxCare:Ubuntu:18.04 | python3.6-minimal | — |
| python3.6-venv | affected | TuxCare:Ubuntu:18.04 | python3.6-venv | — |
Fix CVE(s): CVE-2022-48565
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| idle-python2.7 | affected | TuxCare:Ubuntu:18.04 | idle-python2.7 | — |
| libpython2.7 | affected | TuxCare:Ubuntu:18.04 | libpython2.7 | — |
| libpython2.7-dev | affected | TuxCare:Ubuntu:18.04 | libpython2.7-dev | — |
| libpython2.7-minimal | affected | TuxCare:Ubuntu:18.04 | libpython2.7-minimal | — |
| libpython2.7-stdlib | affected | TuxCare:Ubuntu:18.04 | libpython2.7-stdlib | — |
| libpython2.7-testsuite | affected | TuxCare:Ubuntu:18.04 | libpython2.7-testsuite | — |
| python2.7 | affected | TuxCare:Ubuntu:18.04 | python2.7 | — |
| python2.7-dev | affected | TuxCare:Ubuntu:18.04 | python2.7-dev | — |
| python2.7-doc | affected | TuxCare:Ubuntu:18.04 | python2.7-doc | — |
| python2.7-examples | affected | TuxCare:Ubuntu:18.04 | python2.7-examples | — |
| python2.7-minimal | affected | TuxCare:Ubuntu:18.04 | python2.7-minimal | — |
Fix CVE(s): CVE-2022-48565
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| idle-python3.5 | affected | TuxCare:Ubuntu:16.04 | idle-python3.5 | — |
| libpython3.5 | affected | TuxCare:Ubuntu:16.04 | libpython3.5 | — |
| libpython3.5-dev | affected | TuxCare:Ubuntu:16.04 | libpython3.5-dev | — |
| libpython3.5-minimal | affected | TuxCare:Ubuntu:16.04 | libpython3.5-minimal | — |
| libpython3.5-stdlib | affected | TuxCare:Ubuntu:16.04 | libpython3.5-stdlib | — |
| libpython3.5-testsuite | affected | TuxCare:Ubuntu:16.04 | libpython3.5-testsuite | — |
| python3.5 | affected | TuxCare:Ubuntu:16.04 | python3.5 | — |
| python3.5-dev | affected | TuxCare:Ubuntu:16.04 | python3.5-dev | — |
| python3.5-doc | affected | TuxCare:Ubuntu:16.04 | python3.5-doc | — |
| python3.5-examples | affected | TuxCare:Ubuntu:16.04 | python3.5-examples | — |
| python3.5-minimal | affected | TuxCare:Ubuntu:16.04 | python3.5-minimal | — |
| python3.5-venv | affected | TuxCare:Ubuntu:16.04 | python3.5-venv | — |
Fix CVE(s): CVE-2022-48565
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| idle-python2.7 | affected | TuxCare:Ubuntu:16.04 | idle-python2.7 | — |
| libpython2.7 | affected | TuxCare:Ubuntu:16.04 | libpython2.7 | — |
| libpython2.7-dev | affected | TuxCare:Ubuntu:16.04 | libpython2.7-dev | — |
| libpython2.7-minimal | affected | TuxCare:Ubuntu:16.04 | libpython2.7-minimal | — |
| libpython2.7-stdlib | affected | TuxCare:Ubuntu:16.04 | libpython2.7-stdlib | — |
| libpython2.7-testsuite | affected | TuxCare:Ubuntu:16.04 | libpython2.7-testsuite | — |
| python2.7 | affected | TuxCare:Ubuntu:16.04 | python2.7 | — |
| python2.7-dev | affected | TuxCare:Ubuntu:16.04 | python2.7-dev | — |
| python2.7-doc | affected | TuxCare:Ubuntu:16.04 | python2.7-doc | — |
| python2.7-examples | affected | TuxCare:Ubuntu:16.04 | python2.7-examples | — |
| python2.7-minimal | affected | TuxCare:Ubuntu:16.04 | python2.7-minimal | — |
Security update for SUSE Manager Client Tools
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang-github-lusitaniae-apache_exporter | affected | SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | golang-github-lusitaniae-apache_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | golang-github-prometheus-node_exporter | — |
| golang-github-QubitProducts-exporter_exporter | affected | SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | golang-github-QubitProducts-exporter_exporter | — |
| prometheus-postgres_exporter | affected | SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | prometheus-postgres_exporter | — |
| scap-security-guide | affected | SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | scap-security-guide | — |
| spacecmd | affected | SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | spacecmd | — |
Security update for SUSE Manager Client Tools
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang-github-lusitaniae-apache_exporter | affected | SUSE:EL-9:Update:Products:ManagerTools:Update | golang-github-lusitaniae-apache_exporter | — |
| golang-github-lusitaniae-apache_exporter | affected | SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | golang-github-lusitaniae-apache_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:EL-9:Update:Products:ManagerTools:Update | golang-github-prometheus-node_exporter | — |
| golang-github-QubitProducts-exporter_exporter | affected | SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | golang-github-QubitProducts-exporter_exporter | — |
| golang-github-QubitProducts-exporter_exporter | affected | SUSE:EL-9:Update:Products:ManagerTools:Update | golang-github-QubitProducts-exporter_exporter | — |
| prometheus-postgres_exporter | affected | SUSE:EL-9:Update:Products:ManagerTools:Update | prometheus-postgres_exporter | — |
| prometheus-postgres_exporter | affected | SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | prometheus-postgres_exporter | — |
| scap-security-guide | affected | SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | scap-security-guide | — |
| scap-security-guide | affected | SUSE:EL-9:Update:Products:ManagerTools:Update | scap-security-guide | — |
| spacecmd | affected | SUSE:EL-9:Update:Products:ManagerTools:Update | spacecmd | — |
| spacecmd | affected | SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | spacecmd | — |
Security update for SUSE Manager Client Tools
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang-github-lusitaniae-apache_exporter | affected | SUSE:Manager Proxy Module 4.3 | golang-github-lusitaniae-apache_exporter | — |
| golang-github-lusitaniae-apache_exporter | affected | openSUSE:Leap 15.5 | golang-github-lusitaniae-apache_exporter | — |
| golang-github-lusitaniae-apache_exporter | affected | SUSE:Manager Client Tools 15 | golang-github-lusitaniae-apache_exporter | — |
| golang-github-lusitaniae-apache_exporter | affected | openSUSE:Leap 15.4 | golang-github-lusitaniae-apache_exporter | — |
| golang-github-lusitaniae-apache_exporter | affected | SUSE:Manager Server Module 4.3 | golang-github-lusitaniae-apache_exporter | — |
| golang-github-lusitaniae-apache_exporter | affected | SUSE:Manager Server Module 4.2 | golang-github-lusitaniae-apache_exporter | — |
| golang-github-lusitaniae-apache_exporter | affected | SUSE:Manager Proxy Module 4.2 | golang-github-lusitaniae-apache_exporter | — |
| golang-github-prometheus-prometheus | affected | SUSE:Manager Client Tools 15 | golang-github-prometheus-prometheus | — |
| golang-github-QubitProducts-exporter_exporter | affected | SUSE:Manager Client Tools 15 | golang-github-QubitProducts-exporter_exporter | — |
| golang-github-QubitProducts-exporter_exporter | affected | SUSE:Manager Server Module 4.2 | golang-github-QubitProducts-exporter_exporter | — |
| golang-github-QubitProducts-exporter_exporter | affected | openSUSE:Leap 15.4 | golang-github-QubitProducts-exporter_exporter | — |
| golang-github-QubitProducts-exporter_exporter | affected | SUSE:Manager Server Module 4.3 | golang-github-QubitProducts-exporter_exporter | — |
| golang-github-QubitProducts-exporter_exporter | affected | SUSE:Manager Proxy Module 4.2 | golang-github-QubitProducts-exporter_exporter | — |
| golang-github-QubitProducts-exporter_exporter | affected | openSUSE:Leap 15.5 | golang-github-QubitProducts-exporter_exporter | — |
| golang-github-QubitProducts-exporter_exporter | affected | SUSE:Manager Client Tools for SLE Micro 5 | golang-github-QubitProducts-exporter_exporter | — |
| golang-github-QubitProducts-exporter_exporter | affected | SUSE:Manager Proxy Module 4.3 | golang-github-QubitProducts-exporter_exporter | — |
| grafana | affected | SUSE:Manager Client Tools 15 | grafana | — |
| prometheus-blackbox_exporter | affected | openSUSE:Leap 15.5 | prometheus-blackbox_exporter | — |
| prometheus-blackbox_exporter | affected | SUSE:Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | — |
| prometheus-blackbox_exporter | affected | SUSE:Manager Proxy Module 4.2 | prometheus-blackbox_exporter | — |
| prometheus-blackbox_exporter | affected | SUSE:Manager Proxy Module 4.3 | prometheus-blackbox_exporter | — |
| prometheus-blackbox_exporter | affected | SUSE:Manager Client Tools 15 | prometheus-blackbox_exporter | — |
| prometheus-blackbox_exporter | affected | openSUSE:Leap 15.4 | prometheus-blackbox_exporter | — |
| prometheus-postgres_exporter | affected | openSUSE:Leap 15.5 | prometheus-postgres_exporter | — |
| prometheus-postgres_exporter | affected | SUSE:Manager Server Module 4.2 | prometheus-postgres_exporter | — |
| prometheus-postgres_exporter | affected | SUSE:Manager Client Tools 15 | prometheus-postgres_exporter | — |
| prometheus-postgres_exporter | affected | openSUSE:Leap 15.4 | prometheus-postgres_exporter | — |
| python-pyvmomi | affected | SUSE:Manager Client Tools 15 | python-pyvmomi | — |
| spacecmd | affected | SUSE:Manager Client Tools 15 | spacecmd | — |
| spacecmd | affected | openSUSE:Leap 15.4 | spacecmd | — |
| spacecmd | affected | openSUSE:Leap 15.5 | spacecmd | — |
| supportutils-plugin-susemanager-client | affected | openSUSE:Leap 15.5 | supportutils-plugin-susemanager-client | — |
| supportutils-plugin-susemanager-client | affected | openSUSE:Leap 15.4 | supportutils-plugin-susemanager-client | — |
| supportutils-plugin-susemanager-client | affected | SUSE:Manager Client Tools 15 | supportutils-plugin-susemanager-client | — |
| uyuni-common-libs | affected | SUSE:Manager Client Tools 15 | uyuni-common-libs | — |
Security update for SUSE Manager Client Tools
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang-github-lusitaniae-apache_exporter | affected | SUSE:Manager Client Tools 12 | golang-github-lusitaniae-apache_exporter | — |
| golang-github-prometheus-alertmanager | affected | SUSE:Manager Client Tools 12 | golang-github-prometheus-alertmanager | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise Server 12 SP5 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Manager Client Tools 12 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-prometheus | affected | SUSE:Manager Client Tools 12 | golang-github-prometheus-prometheus | — |
| golang-github-QubitProducts-exporter_exporter | affected | SUSE:Manager Client Tools 12 | golang-github-QubitProducts-exporter_exporter | — |
| grafana | affected | SUSE:Manager Client Tools 12 | grafana | — |
| prometheus-blackbox_exporter | affected | SUSE:Manager Client Tools 12 | prometheus-blackbox_exporter | — |
| prometheus-postgres_exporter | affected | SUSE:Manager Client Tools 12 | prometheus-postgres_exporter | — |
| spacecmd | affected | SUSE:Manager Client Tools 12 | spacecmd | — |
| supportutils-plugin-susemanager-client | affected | SUSE:Manager Client Tools 12 | supportutils-plugin-susemanager-client | — |
| uyuni-common-libs | affected | SUSE:Manager Client Tools 12 | uyuni-common-libs | — |
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command f...
CVEs:CVE-2023-39320
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| go | affected | golang | — | — |
CVEs:CVE-2023-39320
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.
CVEs:CVE-2023-39320
Security update for Golang Prometheus
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang-github-prometheus-alertmanager | affected | SUSE:Manager Proxy Module 4.3 | golang-github-prometheus-alertmanager | — |
| golang-github-prometheus-alertmanager | affected | SUSE:Manager Client Tools 15 | golang-github-prometheus-alertmanager | — |
| golang-github-prometheus-alertmanager | affected | SUSE:Linux Enterprise Module for Package Hub 15 SP5 | golang-github-prometheus-alertmanager | — |
| golang-github-prometheus-alertmanager | affected | SUSE:Manager Proxy Module 4.2 | golang-github-prometheus-alertmanager | — |
| golang-github-prometheus-alertmanager | affected | openSUSE:Leap 15.4 | golang-github-prometheus-alertmanager | — |
| golang-github-prometheus-alertmanager | affected | openSUSE:Leap 15.5 | golang-github-prometheus-alertmanager | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Manager Client Tools for SLE Micro 5 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise Server 15 SP1-LTSS | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise Server 15 SP2-LTSS | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise Server 15 SP3-LTSS | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Manager Proxy 4.2 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Manager Server 4.2 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Enterprise Storage 7.1 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise Module for Basesystem 15 SP4 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | SUSE:Linux Enterprise Module for Basesystem 15 SP5 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | openSUSE:Leap 15.5 | golang-github-prometheus-node_exporter | — |
| golang-github-prometheus-node_exporter | affected | openSUSE:Leap 15.4 | golang-github-prometheus-node_exporter | — |
golang security update
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang | affected | openEuler:22.03-LTS-SP1 | golang | — |
DEBIAN-CVE-2023-5186
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: High)
CVEs:CVE-2023-5186
CVEs:CVE-2023-5186
Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: High)
CVEs:CVE-2023-5186
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
CVE-2023-39318 affecting package golang for versions less than 1.20.10-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang | affected | Azure Linux:2 | golang | — |
CVE-2023-39318 affecting package msft-golang for versions less than 1.20.10-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| msft-golang | affected | Azure Linux:2 | msft-golang | — |
CVE-2023-39318 affecting package golang for versions less than 1.21.6-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang | affected | Azure Linux:2 | golang | — |
CVE-2023-39318 affecting package golang for versions less than 1.21.6-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang | affected | Azure Linux:2 | golang | — |
CVE-2023-39318 affecting package golang for versions less than 1.20.10-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang | affected | Azure Linux:3 | golang | — |
CVE-2023-39318 affecting package golang 1.25.7-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang | affected | Azure Linux:3 | golang | — |
DEBIAN-CVE-2023-39318
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang-1.15 | affected | Debian:11 | golang-1.15 | — |
| golang-1.19 | affected | Debian:12 | golang-1.19 | — |
Improper handling of HTML-like comments in script contexts in html/template
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| kind | affected | chainguard | kind | — |
| kind | affected | wolfi | kind | — |
| kubeflow-katib | affected | chainguard | kubeflow-katib | — |
| kubeflow-katib | affected | wolfi | kubeflow-katib | — |
| metrics-server | affected | chainguard | metrics-server | — |
| metrics-server | affected | wolfi | metrics-server | — |
| stdlib | affected | Go | stdlib | — |
| stdlib | affected | Go | — | — |
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.
CVEs:CVE-2023-39318
CVEs:CVE-2023-39318
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be ...
CVEs:CVE-2023-39318
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| go | affected | golang | — | — |
CVE-2023-39319 affecting package golang for versions less than 1.20.10-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang | affected | Azure Linux:2 | golang | — |
CVE-2023-39319 affecting package msft-golang for versions less than 1.20.10-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| msft-golang | affected | Azure Linux:2 | msft-golang | — |
CVE-2023-39319 affecting package golang for versions less than 1.20.10-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang | affected | Azure Linux:3 | golang | — |
CVE-2023-39319 affecting package golang for versions less than 1.21.6-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang | affected | Azure Linux:2 | golang | — |
CVE-2023-39319 affecting package golang for versions less than 1.21.6-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang | affected | Azure Linux:2 | golang | — |
CVE-2023-39319 affecting package golang 1.25.7-1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang | affected | Azure Linux:3 | golang | — |
DEBIAN-CVE-2023-39319
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang-1.15 | affected | Debian:11 | golang-1.15 | — |
| golang-1.19 | affected | Debian:12 | golang-1.19 | — |
Improper handling of special tags within script contexts in html/template
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| kind | affected | chainguard | kind | — |
| kind | affected | wolfi | kind | — |
| kubeflow-katib | affected | wolfi | kubeflow-katib | — |
| kubeflow-katib | affected | chainguard | kubeflow-katib | — |
| metrics-server | affected | chainguard | metrics-server | — |
| metrics-server | affected | wolfi | metrics-server | — |
| stdlib | affected | Go | stdlib | — |
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.
CVEs:CVE-2023-39319
CVEs:CVE-2023-39319
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated ...
CVEs:CVE-2023-39319
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| go | affected | golang | — | — |
DEBIAN-CVE-2023-5187
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-5187
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
CVEs:CVE-2023-5187
Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-5187
grpc security update
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| grpc | affected | openEuler:20.03-LTS-SP3 | grpc | — |
| grpc | affected | openEuler:22.03-LTS | grpc | — |
| grpc | affected | openEuler:22.03-LTS-SP1 | grpc | — |
| grpc | affected | openEuler:22.03-LTS-SP2 | grpc | — |
Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| grpc | affected | RubyGems | grpc | — |
| grpcio | affected | PyPI | grpcio | — |
Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| grpc | affected | RubyGems | grpc | — |
| grpcio | affected | PyPI | grpcio | — |
| grpcio | affected | PyPI | grpcio | — |
| kube-fluentd-operator | affected | chainguard | kube-fluentd-operator | — |
| kube-fluentd-operator | affected | wolfi | kube-fluentd-operator | — |
CVE-2023-4785 affecting package grpc for versions less than 1.62.0-2
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| grpc | affected | Azure Linux:3 | grpc | — |
DEBIAN-CVE-2023-4785
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| grpc | affected | Debian:11 | grpc | — |
| grpc | affected | Debian:12 | grpc | — |
| grpc | affected | Debian:13 | grpc | — |
| grpc | affected | Debian:14 | grpc | — |
BELL-CVE-2023-4785
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| grpc | affected | Alpaquita:stream | grpc | — |
| grpc | affected | Alpaquita:23 | grpc | — |
Security update for chromium
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | SUSE:Package Hub 15 SP5 | chromium | — |
| chromium | affected | openSUSE:Leap 15.4 | chromium | — |
| chromium | affected | openSUSE:Leap 15.5 | chromium | — |
| chromium | affected | SUSE:Package Hub 15 SP4 | chromium | — |
Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
CVEs:CVE-2023-4901
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
CVEs:CVE-2023-4901
DEBIAN-CVE-2023-4901
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
CVEs:CVE-2023-4905
Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
CVEs:CVE-2023-4905
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
DEBIAN-CVE-2023-4905
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)
CVEs:CVE-2023-4907
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
CVEs:CVE-2023-4907
DEBIAN-CVE-2023-4907
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a permission prompt via a crafted HTML page. (Chromium security severity: Medium)
CVEs:CVE-2023-4900
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
CVEs:CVE-2023-4900
Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
CVEs:CVE-2023-4902
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
CVEs:CVE-2023-4902
CVEs:CVE-2023-4903
Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)
CVEs:CVE-2023-4903
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
DEBIAN-CVE-2023-4900
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
| chromium | affected | Debian:11 | chromium | — |
DEBIAN-CVE-2023-4902
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
DEBIAN-CVE-2023-4903
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
Insufficient policy enforcement in Autofill in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low)
CVEs:CVE-2023-4906
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
CVEs:CVE-2023-4906
DEBIAN-CVE-2023-4906
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
CVEs:CVE-2023-4908
Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)
CVEs:CVE-2023-4908
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)
CVEs:CVE-2023-4909
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
CVEs:CVE-2023-4909
DEBIAN-CVE-2023-4908
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
DEBIAN-CVE-2023-4909
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
Insufficient policy enforcement in Downloads in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Enterprise policy restrictions via a crafted download. (Chromium security severity: Medium)
CVEs:CVE-2023-4904
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
| fedora | affected | fedoraproject | — | — |
CVEs:CVE-2023-4904
DEBIAN-CVE-2023-4904
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVEs:CVE-2023-35681
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-35681
DEBIAN-CVE-2023-36308
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang-github-disintegration-imaging | affected | Debian:12 | golang-github-disintegration-imaging | — |
| golang-github-disintegration-imaging | affected | Debian:11 | golang-github-disintegration-imaging | — |
| golang-github-disintegration-imaging | affected | Debian:13 | golang-github-disintegration-imaging | — |
| golang-github-disintegration-imaging | affected | Debian:14 | golang-github-disintegration-imaging | — |
In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read the full card number and expiry details when the device is in locked screen mode due to a logic error in the code. This could lead to ...
CVEs:CVE-2023-35671
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-35671
CVEs:CVE-2023-35687
In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVEs:CVE-2023-35687
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-36735
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVEs:CVE-2023-36735
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| edge_chromium | affected | microsoft | — | — |
CVEs:CVE-2023-44216
PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification, aka a GPU.zip issue. ...
CVEs:CVE-2023-44216
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| core_i7-10510u | affected | intel | — | — |
| core_i7-10610u | affected | intel | — | — |
| core_i7-11800h | affected | intel | — | — |
| core_i7-12700k | affected | intel | — | — |
| core_i7-8700 | affected | intel | — | — |
| geforce_rtx_2080_super | affected | nvidia | — | — |
| geforce_rtx_3060 | affected | nvidia | — | — |
| m1_mac_mini | affected | apple | — | — |
| macos | affected | apple | — | — |
| pixel_6 | affected | — | — | |
| ryzen_5_7600x | affected | amd | — | — |
| ryzen_7_4800u | affected | amd | — | — |
| ubuntu_linux | affected | canonical | — | — |
| windows_10 | affected | microsoft | — | — |
| windows_11 | affected | microsoft | — | — |
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". ...
CVEs:CVE-2023-39323
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| fedora | affected | fedoraproject | — | — |
| go | affected | golang | — | — |
CVEs:CVE-2023-39323
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
CVEs:CVE-2023-39323
Panic when processing post-handshake message on QUIC connections in crypto/tls
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| metrics-server | affected | wolfi | metrics-server | — |
| metrics-server | affected | chainguard | metrics-server | — |
| stdlib | affected | Go | stdlib | — |
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
CVEs:CVE-2023-39321
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
CVEs:CVE-2023-39321
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| go | affected | golang | — | — |
CVEs:CVE-2023-39321
Memory exhaustion in QUIC connection handling in crypto/tls
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| metrics-server | affected | wolfi | metrics-server | — |
| metrics-server | affected | chainguard | metrics-server | — |
| stdlib | affected | Go | stdlib | — |
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65...
CVEs:CVE-2023-39322
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| go | affected | golang | — | — |
CVEs:CVE-2023-39322
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.
CVEs:CVE-2023-39322
DEBIAN-CVE-2023-4764
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium | affected | Debian:11 | chromium | — |
| chromium | affected | Debian:12 | chromium | — |
| chromium | affected | Debian:13 | chromium | — |
| chromium | affected | Debian:14 | chromium | — |
CVEs:CVE-2023-4764
Incorrect security UI in BFCache in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-4764
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — | |
| debian_linux | affected | debian | — | — |
Incorrect security UI in BFCache in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)
CVEs:CVE-2023-4764
DEBIAN-CVE-2023-42821
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| golang-github-gomarkdown-markdown | affected | Debian:12 | golang-github-gomarkdown-markdown | — |
| golang-github-gomarkdown-markdown | affected | Debian:13 | golang-github-gomarkdown-markdown | — |
| golang-github-gomarkdown-markdown | affected | Debian:14 | golang-github-gomarkdown-markdown | — |
CVEs:CVE-2023-36727
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVEs:CVE-2023-36727
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| edge_chromium | affected | microsoft | — | — |
CVEs:CVE-2023-36562
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVEs:CVE-2023-36562
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| edge_chromium | affected | microsoft | — | — |
Jenkins Google Login Plugin non-constant time token comparison
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| org.jenkins-ci.plugins:google-login | affected | Maven | org.jenkins-ci.plugins:google-login | — |
Jenkins Google Login Plugin non-constant time token comparison
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| org.jenkins-ci.plugins:google-login | affected | Maven | org.jenkins-ci.plugins:google-login | — |
Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, potentially allowing attackers to use statistical methods to obtain a valid token.
CVEs:CVE-2023-41936
Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, potentially allowing attackers to use statistical methods to obtain a valid token.
CVEs:CVE-2023-41936
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| google_login | affected | jenkins | — | — |
Jenkins Google Login Plugin non-constant time token comparison
CVEs:CVE-2023-41936
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| org.jenkins-ci.plugins:google-login | affected | Maven | org.jenkins-ci.plugins:google-login | — |
A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arbitrary files inside the app's container. The internal database of the framework is exposed to the local user if ...
CVEs:CVE-2023-41387
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| flutter_downloader | affected | patreon | — | — |
CVEs:CVE-2023-41387
CVEs:CVE-2023-4887
The Google Maps Plugin by Intergeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'intergeo' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes...
CVEs:CVE-2023-4887
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| google_maps_plugin_by_intergeo | affected | themeisle | — | — |
In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed ...
CVEs:CVE-2023-35658
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-35658
CVEs:CVE-2023-35683
In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed...
CVEs:CVE-2023-35683
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVEs:CVE-2023-35684
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-35684
The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Bluetooth ("com.lge.bluetoothsetting") app. The attacker's app, if i...
CVEs:CVE-2023-44123
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-44123
The vulnerability is the use of implicit PendingIntents without the PendingIntent.FLAG_IMMUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Personalized service ("com.lge.abba") app. The attacker's app, ...
CVEs:CVE-2023-44125
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-44125
he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact detail...
CVEs:CVE-2023-44127
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-44127
CVEs:CVE-2023-44126
The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data suc...
CVEs:CVE-2023-44126
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
ASB-A-285903020
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| :linux_kernel:Qualcomm | affected | Android | :linux_kernel:Qualcomm | — |
| vendor/qcom/opensource/graphics-kernel | affected | platform | platform/vendor/qcom/opensource/graphics-kernel | — |
In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files played by another user on the same device due to a logic error in the code. This could lead to local information disclosure with no addi...
CVEs:CVE-2023-35675
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-35675
CVEs:CVE-2023-20849
In imgsys_cmdq, there is a possible use after free due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433; Iss...
CVEs:CVE-2023-20849
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-35669
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running activities due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed...
CVEs:CVE-2023-35669
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-35679
In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVEs:CVE-2023-35679
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-35682
In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
CVEs:CVE-2023-35682
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-20850
In imgsys_cmdq, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433...
CVEs:CVE-2023-20850
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
In imgsys, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Iss...
CVEs:CVE-2023-20841
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20841
In imgsys_cmdq, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS0735425...
CVEs:CVE-2023-20842
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20842
CVEs:CVE-2023-20848
In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433;...
CVEs:CVE-2023-20848
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20840
In imgsys, there is a possible out of bounds read and write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS0732...
CVEs:CVE-2023-20840
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-35665
In multiple files, there is a possible way to import a contact from another user due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for expl...
CVEs:CVE-2023-35665
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-32812
In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local esclation of privileges with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08017365...
CVEs:CVE-2023-32812
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| openwrt | affected | openwrt | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-32809
CVEs:CVE-2023-32808
In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340119; ...
CVEs:CVE-2023-20843
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20843
In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07354058; ...
CVEs:CVE-2023-20844
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20844
In imgsys, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07197795; Issue...
CVEs:CVE-2023-20845
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20845
CVEs:CVE-2023-20846
In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07354023; ...
CVEs:CVE-2023-20846
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
In imgsys, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Issue...
CVEs:CVE-2023-20839
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20839
In bluetooth driver, there is a possible read and write access to registers due to improper access control of register interface. This could lead to local leak of sensitive information with System execution privileges needed. User interaction is not ne...
CVEs:CVE-2023-32809
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In bluetooth driver, there is a possible read and write access to registers due to improper access control of register interface. This could lead to local leak of sensitive information with System execution privileges needed. User interaction is not ne...
CVEs:CVE-2023-32808
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-35677
In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could lead to local denial of service (factory reset or continuous locking) with no additional execution privileges neede...
CVEs:CVE-2023-35677
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-44122
The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java" file. The main problem is that the app...
CVEs:CVE-2023-44122
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In bta_av_rc_msg of bta_av_act.cc, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVEs:CVE-2023-35666
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-35666
CVEs:CVE-2023-32805
In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local denial of service with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07354025; Issue...
CVEs:CVE-2023-20847
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20847
In seninf, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07992786; Issue I...
CVEs:CVE-2023-20837
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-20837
In power, there is a possible out of bounds write due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08102892; Issue ID:...
CVEs:CVE-2023-32805
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-32817
CVEs:CVE-2023-32815
In gnss service, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08044040; ...
CVEs:CVE-2023-32817
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In gnss service, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08037801; ...
CVEs:CVE-2023-32815
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| openwrt | affected | openwrt | — | — |
| yocto | affected | linuxfoundation | — | — |
The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality...
CVEs:CVE-2023-44129
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-44129
CVEs:CVE-2022-47353
In vdsp device, there is a possible system crash due to improper input validation.This could lead to local denial of service with System execution privileges needed
CVEs:CVE-2022-47353
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2022-48453
In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVEs:CVE-2022-48453
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2022-47352
In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVEs:CVE-2022-47352
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is that the app...
CVEs:CVE-2023-44124
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-44124
In imgsys, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Issue ID: ALPS07326...
CVEs:CVE-2023-20838
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| linux_kernel | affected | linux | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20838
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ...
CVEs:CVE-2023-20828
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| openwrt | affected | openwrt | — | — |
| rdk-b | affected | rdkcentral | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20828
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ...
CVEs:CVE-2023-20829
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| openwrt | affected | openwrt | — | — |
| rdk-b | affected | rdkcentral | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20829
CVEs:CVE-2023-20830
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ...
CVEs:CVE-2023-20830
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| openwrt | affected | openwrt | — | — |
| rdk-b | affected | rdkcentral | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20831
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ...
CVEs:CVE-2023-20831
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| openwrt | affected | openwrt | — | — |
| rdk-b | affected | rdkcentral | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20832
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ...
CVEs:CVE-2023-20832
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| openwrt | affected | openwrt | — | — |
| rdk-b | affected | rdkcentral | — | — |
| yocto | affected | linuxfoundation | — | — |
In nvram, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07937113; Issue ID...
CVEs:CVE-2023-20821
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| openwrt | affected | openwrt | — | — |
| rdk-b | affected | rdkcentral | — | — |
| yocto | affected | linuxfoundation | — | — |
CVEs:CVE-2023-20821
In netdagent, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07944012; Issu...
CVEs:CVE-2023-20822
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-20822
In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed
CVEs:CVE-2023-38553
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38553
CVEs:CVE-2023-20836
In camsys, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07505629; Issue ID:...
CVEs:CVE-2023-20836
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38468
In urild service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVEs:CVE-2023-38468
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In keyinstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08017756; I...
CVEs:CVE-2023-20833
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-20833
In Ifaa service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed
CVEs:CVE-2022-48452
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2022-48452
In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in the settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges...
CVEs:CVE-2023-35667
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-35667
CVEs:CVE-2023-20851
In stc, there is a possible out of bounds read due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08048635; Issue ID: ALPS08048635.
CVEs:CVE-2023-20851
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In cmdq, there is a possible out of bounds read due to an incorrect status check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08021592; Issue ID: ALP...
CVEs:CVE-2023-20823
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-20823
In urild service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVEs:CVE-2023-38467
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38467
CVEs:CVE-2023-35664
In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exp...
CVEs:CVE-2023-35664
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-33916
CVEs:CVE-2023-33917
CVEs:CVE-2023-33918
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-38436
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38436
CVEs:CVE-2023-38437
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-38437
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-38438
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38438
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-38439
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38439
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-33917
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-33918
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-33916
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38554
In wcn bsp driver, there is a possible out of bounds write due to a missing bounds check.This could lead to local denial of service with no additional execution privileges
CVEs:CVE-2023-38554
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38449
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38449
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38450
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38450
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38451
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38451
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38452
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38452
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38453
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38453
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38455
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38455
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38456
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38456
CVEs:CVE-2023-38458
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38458
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38459
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38459
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38460
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38460
CVEs:CVE-2023-38464
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38464
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38443
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38443
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVEs:CVE-2023-38444
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38444
CVEs:CVE-2023-20825
In duraspeed, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID: ALPS07...
CVEs:CVE-2023-20825
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-20826
In cta, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID: ALPS07978550...
CVEs:CVE-2023-20826
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-20824
In duraspeed, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID: ALPS07...
CVEs:CVE-2023-20824
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-38466
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38466
In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-38454
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38454
CVEs:CVE-2023-38465
In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-38465
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-38440
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38440
CVEs:CVE-2023-38441
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-38441
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38442
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVEs:CVE-2023-38442
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38447
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
CVEs:CVE-2023-38447
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
CVEs:CVE-2023-38448
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38448
CVEs:CVE-2023-38457
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
CVEs:CVE-2023-38457
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38461
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
CVEs:CVE-2023-38461
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38462
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
CVEs:CVE-2023-38462
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38463
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
CVEs:CVE-2023-38463
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38445
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
CVEs:CVE-2023-38445
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
CVEs:CVE-2023-38446
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-38446
he vulnerability is to delete arbitrary files in LGInstallService ("com.lge.lginstallservies") app. The app contains the exported "com.lge.lginstallservies.InstallService" service that exposes an AIDL interface. All its "installPackage*" methods are fi...
CVEs:CVE-2023-44128
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-44128
CVEs:CVE-2023-20834
In pda, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07608514; Issue ID: ALPS07608514.
CVEs:CVE-2023-20834
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-20835
In camsys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07341261; Issue ID: ALPS0732...
CVEs:CVE-2023-20835
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| iot_yocto | affected | mediatek | — | — |
| yocto | affected | linuxfoundation | — | — |
In ims service, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07937105; Issue ID: ...
CVEs:CVE-2023-20827
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-20827
CVEs:CVE-2023-29332
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
CVEs:CVE-2023-29332
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| azure_kubernetes_service | affected | microsoft | — | — |
x/net/html Vulnerable to DoS During HTML Parsing
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| x/net | affected | golang.org | golang.org/x/net | — |
x/net/html Vulnerable to DoS During HTML Parsing
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| x/net | affected | golang.org | golang.org/x/net | — |
Improper authorization in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows attacker to read arbitrary file with system privilege.
CVEs:CVE-2023-30706
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
CVEs:CVE-2023-30706
Improper authorization vulnerability in FolderContainerDragDelegate in One UI Home prior to SMR Sep-2023 Release 1 allows physical attackers to change some settings of the folder lock.
CVEs:CVE-2023-30714
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
CVEs:CVE-2023-30714
CVEs:CVE-2023-35673
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for e...
CVEs:CVE-2023-35673
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
Insertion of sensitive information into log vulnerability in Locksettings prior to SMR Sep-2023 Release 1 allows a privileged local attacker to get lock screen match information from the log.
CVEs:CVE-2023-30721
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
CVEs:CVE-2023-30721
Improper input validation vulnerability in FileProviderStatusReceiver in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows local attackers to delete arbitrary files with Samsung Keyboard privilege.
CVEs:CVE-2023-30707
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
CVEs:CVE-2023-30707
CVEs:CVE-2023-30719
Exposure of Sensitive Information vulnerability in InboundSmsHandler prior to SMR Sep-2023 Release 1 allows local attackers to access certain message data.
CVEs:CVE-2023-30719
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
CVEs:CVE-2023-30716
Improper access control vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to trigger certain commands.
CVEs:CVE-2023-30716
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
Improper export of android application components vulnerability in WifiApAutoHotspotEnablingActivity prior to SMR Sep-2023 Release 1 allows local attacker to change a Auto Hotspot setting.
CVEs:CVE-2023-30718
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | samsung | — | — |
CVEs:CVE-2023-30718
CVEs:CVE-2023-35680
In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for expl...
CVEs:CVE-2023-35680
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private directories due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges need...
CVEs:CVE-2023-35670
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2023-35670
CVEs:CVE-2023-35676
In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed...
CVEs:CVE-2023-35676
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
Paths outside of the rootfs could be produced on Windows in github.com/cyphar/filepath-securejoin
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| cadvisor | affected | chainguard | cadvisor | — |
| cadvisor | affected | wolfi | cadvisor | — |
| ctop | affected | chainguard | ctop | — |
| ctop | affected | wolfi | ctop | — |
| cyphar/filepath-securejoin | affected | github.com | github.com/cyphar/filepath-securejoin | — |
| flux-helm-controller | affected | wolfi | flux-helm-controller | — |
| flux-helm-controller | affected | chainguard | flux-helm-controller | — |
| flux-image-automation-controller | affected | wolfi | flux-image-automation-controller | — |
| flux-image-automation-controller | affected | chainguard | flux-image-automation-controller | — |
| flux-kustomize-controller | affected | wolfi | flux-kustomize-controller | — |
| flux-kustomize-controller | affected | chainguard | flux-kustomize-controller | — |
| flux-notification-controller | affected | chainguard | flux-notification-controller | — |
| flux-notification-controller | affected | wolfi | flux-notification-controller | — |
| flux-source-controller | affected | chainguard | flux-source-controller | — |
| flux-source-controller | affected | wolfi | flux-source-controller | — |
| helm | affected | wolfi | helm | — |
| helm | affected | chainguard | helm | — |
| helm-3 | affected | wolfi | helm-3 | — |
| helm-3 | affected | chainguard | helm-3 | — |
| helm-4 | affected | chainguard | helm-4 | — |
| helm-4 | affected | wolfi | helm-4 | — |
| helm-push | affected | chainguard | helm-push | — |
| helm-push | affected | wolfi | helm-push | — |
| k3s | affected | chainguard | k3s | — |
| k3s | affected | wolfi | k3s | — |
| k8sgpt | affected | wolfi | k8sgpt | — |
| k8sgpt | affected | chainguard | k8sgpt | — |
| kots | affected | chainguard | kots | — |
| kots | affected | wolfi | kots | — |
| kubevela | affected | wolfi | kubevela | — |
| kubevela | affected | chainguard | kubevela | — |
| node-problem-detector-0.8 | affected | chainguard | node-problem-detector-0.8 | — |
| pulumi-kubernetes-operator | affected | chainguard | pulumi-kubernetes-operator | — |
| pulumi-kubernetes-operator | affected | wolfi | pulumi-kubernetes-operator | — |
| runc | affected | wolfi | runc | — |
| runc | affected | chainguard | runc | — |
| tomcat-8.5.87 | affected | chainguard | tomcat-8.5.87 | — |
| up | affected | chainguard | up | — |
| up | affected | wolfi | up | — |
| zot | affected | chainguard | zot | — |
| zot | affected | wolfi | zot | — |
SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| cyphar/filepath-securejoin | affected | github.com | github.com/cyphar/filepath-securejoin | — |
SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| argo-cd-2.7 | affected | chainguard | argo-cd-2.7 | — |
| argo-cd-2.7 | affected | wolfi | argo-cd-2.7 | — |
| argo-cd-2.8 | affected | chainguard | argo-cd-2.8 | — |
| argo-cd-2.8 | affected | wolfi | argo-cd-2.8 | — |
| cadvisor | affected | wolfi | cadvisor | — |
| cadvisor | affected | chainguard | cadvisor | — |
| ctop | affected | wolfi | ctop | — |
| ctop | affected | chainguard | ctop | — |
| cyphar/filepath-securejoin | affected | github.com | — | — |
| cyphar/filepath-securejoin | affected | github.com | github.com/cyphar/filepath-securejoin | — |
| cyphar/filepath-securejoin | affected | github.com | github.com/cyphar/filepath-securejoin | — |
| flux-0 | affected | chainguard | flux-0 | — |
| flux-0.37 | affected | chainguard | flux-0.37 | — |
| flux-helm-controller | affected | wolfi | flux-helm-controller | — |
| flux-helm-controller | affected | chainguard | flux-helm-controller | — |
| flux-helm-controller-0 | affected | chainguard | flux-helm-controller-0 | — |
| flux-helm-controller-0.37 | affected | chainguard | flux-helm-controller-0.37 | — |
| flux-image-automation-controller | affected | wolfi | flux-image-automation-controller | — |
| flux-image-automation-controller | affected | chainguard | flux-image-automation-controller | — |
| flux-kustomize-controller | affected | chainguard | flux-kustomize-controller | — |
| flux-kustomize-controller | affected | wolfi | flux-kustomize-controller | — |
| flux-kustomize-controller-0 | affected | chainguard | flux-kustomize-controller-0 | — |
| flux-kustomize-controller-0.37 | affected | chainguard | flux-kustomize-controller-0.37 | — |
| flux-notification-controller | affected | chainguard | flux-notification-controller | — |
| flux-notification-controller | affected | wolfi | flux-notification-controller | — |
| flux-notification-controller-0 | affected | chainguard | flux-notification-controller-0 | — |
| flux-source-controller | affected | chainguard | flux-source-controller | — |
| flux-source-controller | affected | wolfi | flux-source-controller | — |
| flux-source-controller-0 | affected | chainguard | flux-source-controller-0 | — |
| flux-source-controller-0.37 | affected | chainguard | flux-source-controller-0.37 | — |
| github.com/cyphar/filepath-securejoin | affected | Go | github.com/cyphar/filepath-securejoin | — |
| helm | affected | chainguard | helm | — |
| helm | affected | wolfi | helm | — |
| helm-3 | affected | wolfi | helm-3 | — |
| helm-3 | affected | chainguard | helm-3 | — |
| helm-4 | affected | wolfi | helm-4 | — |
| helm-4 | affected | chainguard | helm-4 | — |
| helm-push | affected | wolfi | helm-push | — |
| helm-push | affected | chainguard | helm-push | — |
| istio-operator-1.19 | affected | wolfi | istio-operator-1.19 | — |
| istio-operator-1.19 | affected | chainguard | istio-operator-1.19 | — |
| istio-pilot-agent-1.18 | affected | chainguard | istio-pilot-agent-1.18 | — |
| istio-pilot-agent-1.18 | affected | wolfi | istio-pilot-agent-1.18 | — |
| istio-pilot-discovery-1.19 | affected | chainguard | istio-pilot-discovery-1.19 | — |
| istio-pilot-discovery-1.19 | affected | wolfi | istio-pilot-discovery-1.19 | — |
| k3s | affected | chainguard | k3s | — |
| k3s | affected | wolfi | k3s | — |
| k8sgpt | affected | chainguard | k8sgpt | — |
| k8sgpt | affected | wolfi | k8sgpt | — |
| kots | affected | chainguard | kots | — |
| kots | affected | wolfi | kots | — |
| kubevela | affected | wolfi | kubevela | — |
| kubevela | affected | chainguard | kubevela | — |
| kyverno | affected | wolfi | kyverno | — |
| kyverno | affected | chainguard | kyverno | — |
| node-problem-detector-0.8 | affected | chainguard | node-problem-detector-0.8 | — |
| node-problem-detector-0.8 | affected | wolfi | node-problem-detector-0.8 | — |
| pulumi-kubernetes-operator | affected | wolfi | pulumi-kubernetes-operator | — |
| pulumi-kubernetes-operator | affected | chainguard | pulumi-kubernetes-operator | — |
| runc | affected | chainguard | runc | — |
| runc | affected | wolfi | runc | — |
| tomcat-8.5.87 | affected | chainguard | tomcat-8.5.87 | — |
| up | affected | wolfi | up | — |
| up | affected | chainguard | up | — |
| zot | affected | wolfi | zot | — |
| zot | affected | chainguard | zot | — |
Security update for kubernetes1.18
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| kubernetes1.18 | affected | SUSE:Linux Enterprise Server 15 SP2-LTSS | kubernetes1.18 | — |
| kubernetes1.18 | affected | SUSE:Linux Enterprise Server 15 SP3-LTSS | kubernetes1.18 | — |
| kubernetes1.18 | affected | SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | kubernetes1.18 | — |
| kubernetes1.18 | affected | SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | kubernetes1.18 | — |
| kubernetes1.18 | affected | SUSE:Enterprise Storage 7 | kubernetes1.18 | — |
| kubernetes1.18 | affected | SUSE:Enterprise Storage 7.1 | kubernetes1.18 | — |
| kubernetes1.18 | affected | openSUSE:Leap 15.5 | kubernetes1.18 | — |
| kubernetes1.18 | affected | openSUSE:Leap 15.4 | kubernetes1.18 | — |
| kubernetes1.18 | affected | SUSE:Linux Enterprise Module for Containers 15 SP4 | kubernetes1.18 | — |
| kubernetes1.18 | affected | SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | kubernetes1.18 | — |
| kubernetes1.18 | affected | SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | kubernetes1.18 | — |
| kubernetes1.18 | affected | SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | kubernetes1.18 | — |
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.