CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-26403 – ZDI-CAN-20259: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2023-26403
Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Substance 3D Stager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of USD files. • https://helpx.adobe.com/security/products/substance3d_stager/apsb23-26.html • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-26404 – ZDI-CAN-20143: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2023-26404
Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Dimension. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of USD files. • https://helpx.adobe.com/security/products/dimension/apsb23-27.html • CWE-125: Out-of-bounds Read •
CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27703
https://notcve.org/view.php?id=CVE-2023-27703
The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface. • https://github.com/happy0717/CVE-2023-27703 https://drive.google.com/drive/folders/1Szu9pjivVtG93ceECvnoAjeSABVyfDES?usp=sharing •
CVSS: 7.5EPSS: 4%CPEs: 1EXPL: 3CVE-2023-22620 – SecurePoint UTM 12.x Session ID Leak
https://notcve.org/view.php?id=CVE-2023-22620
The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authentication attempt. ... SecurePoint UTM versions 12.x suffers from a session identifier leak vulnerability via the spcgi.cgi endpoint. • http://packetstormsecurity.com/files/171924/SecurePoint-UTM-12.x-Session-ID-Leak.html http://seclists.org/fulldisclosure/2023/Apr/7 https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22620.txt https://rcesecurity.com • CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28312 – Azure Machine Learning Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2023-28312
Azure Machine Learning Information Disclosure Vulnerability This vulnerability allows local attackers to disclose sensitive information on Microsoft Azure. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28312 • CWE-284: Improper Access Control •