CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41178 – Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2023-41178
Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker. Please note, this vulnerability is similar to, but not identical to, CVE-2023-41176. Las vulnerabilidades de cross-site scripting (XSS) reflejado en Trend Micro Mobile Security (Enterprise) podrían permitir una explotación contra una víctima autenticada que visita un enlace malicioso proporcionado por un atacante. Tenga en cuenta que esta vulnerabilidad es similar, pero no idéntica, a CVE-2023-41176. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the get_response_json_result endpoint. • https://success.trendmicro.com/dcx/s/solution/000294695?language=en_US https://www.zerodayinitiative.com/advisories/ZDI-24-080 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2023-42888 – Apple macOS ImageIO MPO Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2023-42888
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS Monterey 12.7.3, iOS 17.2 and iPadOS 17.2. Processing a maliciously crafted image may result in disclosure of process memory. El problema se solucionó con controles mejorados. Este problema se solucionó en iOS 16.7.5 y iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS Monterey 12.7.3, iOS 17.2 y iPadOS 17.2. • http://seclists.org/fulldisclosure/2024/Jan/34 http://seclists.org/fulldisclosure/2024/Jan/37 http://seclists.org/fulldisclosure/2024/Jan/38 https://support.apple.com/en-us/HT214035 https://support.apple.com/en-us/HT214036 https://support.apple.com/en-us/HT214041 https://support.apple.com/en-us/HT214057 https://support.apple.com/en-us/HT214058 https://support.apple.com/en-us/HT214063 https://support.apple.com/kb/HT214035 https://support.apple.com/kb/HT214036 •
CVSS: 4.6EPSS: 0%CPEs: 3EXPL: 0CVE-2024-23676 – Sensitive Information Disclosure of Index Metrics through “mrollup” SPL Command
https://notcve.org/view.php?id=CVE-2024-23676
In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit. En las versiones de Splunk inferiores a 9.0.8 y 9.1.3, el comando SPL “mrollup” permite a un usuario con pocos privilegios ver métricas en un índice para el que no tiene permiso. Esta vulnerabilidad requiere la interacción de un usuario con altos privilegios para poder explotarla. • https://advisory.splunk.com/advisories/SVD-2024-0106 https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-47152 – IBM Db2 information disclosure
https://notcve.org/view.php?id=CVE-2023-47152
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions. ... IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions. • https://exchange.xforce.ibmcloud.com/vulnerabilities/270730 https://security.netapp.com/advisory/ntap-20240307-0001 https://www.ibm.com/support/pages/node/7105605 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-0775 – Kernel: use-after-free while changing the mount option in __ext4_remount leading
https://notcve.org/view.php?id=CVE-2024-0775
This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free. • https://access.redhat.com/security/cve/CVE-2024-0775 https://bugzilla.redhat.com/show_bug.cgi?id=2259414 https://scm.linefinity.com/common/linux-stable/commit/4c0b4818b1f636bc96359f7817a2d8bab6370162 • CWE-416: Use After Free •