CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2023-21605 – Adobe Acrobat Reader DC Font Parsing Heap-based Buffer Overflow Arbitrary code execution
https://notcve.org/view.php?id=CVE-2023-21605
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. • https://helpx.adobe.com/security/products/acrobat/apsb23-01.html • CWE-122: Heap-based Buffer Overflow •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-21890 – Oracle WebRTC Session Controller parseCert Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-21890
Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Supported versions that are affected are 7.1.0 and 8.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via UDP to compromise Oracle Communications Converged Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). • https://www.oracle.com/security-alerts/cpujan2023.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-21886 – Oracle VirtualBox Teleporter Improper Error Handling Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2023-21886
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). • https://security.gentoo.org/glsa/202310-07 https://www.oracle.com/security-alerts/cpujan2023.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 0CVE-2022-41903 – Integer overflow in `git archive`, `git log --format` leading to RCE in git
https://notcve.org/view.php?id=CVE-2022-41903
This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. ... This integer overflow can result in arbitrary heap writes, which may allow arbitrary code execution. • https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76 https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq https://security.gentoo.org/glsa/202312-15 https://access.redhat.com/security/cve/CVE-2022-41903 https://bugzilla.redhat.com/show_bug.cgi?id=2162056 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22731 – Improper Control of Generation of Code in Twig rendered views in shopware
https://notcve.org/view.php?id=CVE-2023-22731
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**, it is possible to refer to PHP functions in twig filters like `map`, `filter`, `sort`. This allows a template to call any global PHP function and thus execute arbitrary code. The attacker must have access to a Twig environment in order to exploit this vulnerability. This problem has been fixed with 6.4.18.1 with an override of the specified filters until the integration of the Sandbox extension has been finished. • https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates https://github.com/shopware/platform/commit/89d1ea154689cb6202e0d3a0ceeae0febb0c09e1 https://github.com/shopware/platform/security/advisories/GHSA-93cw-f5jj-x85w • CWE-94: Improper Control of Generation of Code ('Code Injection') •