CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2023-6121 – Kernel: nvme: info leak due to out-of-bounds read in nvmet_ctrl_find_get
https://notcve.org/view.php?id=CVE-2023-6121
An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg). Se encontró una vulnerabilidad de lectura fuera de los límites en el subsistema NVMe-oF/TCP del kernel de Linux. Esta falla permite que un atacante remoto envíe un paquete TCP manipulado, lo que desencadena un desbordamiento del búfer que da como resultado que los datos kmalloc se impriman (y potencialmente se filtren) en el búfer de anillo del kernel (dmesg). • https://access.redhat.com/errata/RHSA-2024:2394 https://access.redhat.com/errata/RHSA-2024:2950 https://access.redhat.com/errata/RHSA-2024:3138 https://access.redhat.com/security/cve/CVE-2023-6121 https://bugzilla.redhat.com/show_bug.cgi?id=2250043 https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 788EXPL: 1CVE-2023-6105 – ManageEngine Information Disclosure in Multiple Products
https://notcve.org/view.php?id=CVE-2023-6105
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. • https://www.manageengine.com/security/advisory/CVE/CVE-2023-6105.html https://www.tenable.com/security/research/tra-2023-35 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.7EPSS: 0%CPEs: 3EXPL: 3CVE-2023-5720 – Quarkus: build env information disclosure via gradle plugin
https://notcve.org/view.php?id=CVE-2023-5720
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application. Se encontró una falla en Quarkus, donde no sanitiza adecuadamente los artefactos creados con el complemento Gradle, lo que permite que permanezca cierta información del sistema de compilación. Esta falla permite a un atacante acceder a información potencialmente confidencial desde el sistema de compilación dentro de la aplicación. • https://github.com/miguelc49/CVE-2023-5720-2 https://github.com/miguelc49/CVE-2023-5720-1 https://github.com/miguelc49/CVE-2023-5720-3 https://access.redhat.com/security/cve/CVE-2023-5720 https://bugzilla.redhat.com/show_bug.cgi?id=2245700 • CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22275 – ZDI-CAN-21306: Adobe RoboHelp Server GetNewUserId SQL Injection Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2023-22275
Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to information disclosure by an unauthenticated attacker. • https://helpx.adobe.com/security/products/robohelp-server/apsb23-53.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-47053 – ZDI-CAN-21689: Adobe Audition MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2023-47053
Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Adobe Audition versión 24.0 (y anteriores) y 23.6.1 (y anteriores) se ven afectados por una vulnerabilidad de acceso a puntero no inicializado que podría provocar la divulgación de memoria confidencial. Un atacante podría aprovechar esta vulnerabilidad para evitar mitigaciones como ASLR. • https://helpx.adobe.com/security/products/audition/apsb23-64.html • CWE-824: Access of Uninitialized Pointer •