CVSS: 9.6EPSS: 59%CPEs: 16EXPL: 12CVE-2023-4863 – Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2023-4863
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) El desbordamiento del búfer de memoria en libwebp en Google Chrome anterior a 116.0.5845.187 y libwebp 1.3.2 permitía a un atacante remoto realizar una escritura en memoria fuera de los límites a través de una página HTML manipulada. (Severidad de seguridad de Chromium: crítica) A heap-based buffer flaw was found in the way libwebp, a library used to process "WebP" image format data, processes certain specially formatted WebP images. An attacker could use this flaw to crash or execute remotely arbitrary code in an application such as a web browser compiled with this library. Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. • https://github.com/alsaeroth/CVE-2023-4863-POC https://github.com/mistymntncop/CVE-2023-4863 https://github.com/LiveOverflow/webp-CVE-2023-4863 https://github.com/bbaranoff/CVE-2023-4863 https://github.com/talbeerysec/BAD-WEBP-CVE-2023-4863 https://github.com/huiwen-yayaya/CVE-2023-4863 https://github.com/CrackerCat/CVE-2023-4863- https://github.com/sarsaeroth/CVE-2023-4863-POC http://www.openwall.com/lists/oss-security/2023/09/21/4 http://www.openwall.com/list • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4058
https://notcve.org/view.php?id=CVE-2023-4058
Memory safety bugs present in Firefox 115. ... This vulnerability affects Firefox < 116. Fallos de seguridad de memoria presentes en Firefox 115. ... Esta vulnerabilidad afecta a Firefox versiones anteriores a la 116. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1819160%2C1828024 https://security.gentoo.org/glsa/202401-10 https://www.mozilla.org/security/advisories/mfsa2023-29 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-4057 – Mozilla: Memory safety bugs fixed in Firefox ESR 115.1, and Thunderbird 115.1
https://notcve.org/view.php?id=CVE-2023-4057
Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. ... This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1. Fallos de seguridad de memoria presentes en Firefox 115, Firefox ESR 115.0 y Thunderbird 115.0. ... Esta vulnerabilidad afecta a las versiones anteriores de Firefox 116, Firefox ESR 115.1, y Thunderbird 115.1. The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. • https://bugzilla.mozilla.org/show_bug.cgi?id=1841682 https://www.mozilla.org/security/advisories/mfsa2023-29 https://www.mozilla.org/security/advisories/mfsa2023-31 https://www.mozilla.org/security/advisories/mfsa2023-33 https://access.redhat.com/security/cve/CVE-2023-4057 https://bugzilla.redhat.com/show_bug.cgi?id=2228371 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-4056 – Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
https://notcve.org/view.php?id=CVE-2023-4056
Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. ... This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Fallos de seguridad de memoria presentes en Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0 y Thunderbird 102.13. ... Esta vulnerabilidad afecta a versiones inferiores de Firefox 116, Firefox ESR 102.14, y Firefox ESR 115.1. The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1820587%2C1824634%2C1839235%2C1842325%2C1843847 https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html https://www.debian.org/security/2023/dsa-5464 https://www.debian.org/security/2023/dsa-5469 https://www.mozilla.org/security/advisories/mfsa2023-29 https://www.mozilla.org/security/advisories/mfsa2023-30 https://www.mozilla.org/security/advisories/mfsa2023-31 https& • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 0CVE-2023-37277 – XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API
https://notcve.org/view.php?id=CVE-2023-37277
For regular cookie-based authentication, the vulnerability is mitigated by SameSite cookie restrictions but as of March 2023, these are not enabled by default in Firefox and Safari. • https://github.com/xwiki/xwiki-platform/commit/4c175405faa0e62437df397811c7526dfc0fbae7 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6xxr-648m-gch6 https://jira.xwiki.org/browse/XWIKI-20135 • CWE-352: Cross-Site Request Forgery (CSRF) •