CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4551 – Command Injection via Task Scheduler
https://notcve.org/view.php?id=CVE-2023-4551
29 Jan 2024 — Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS Command Injection. The AppBuilder's Scheduler functionality that facilitates creation of scheduled tasks is vulnerable to command injection. This allows authenticated users to inject arbitrary operating system commands into the executing process. This issue affects AppBuilder: from 21.2 before 23.2. Vulnerabilidad de validación de entrada incorrecta en OpenText AppBuilder en Windows, Linux permite la inyección de coma... • https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4550 – Unauthenticated Arbitrary File Read
https://notcve.org/view.php?id=CVE-2023-4550
29 Jan 2024 — Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An unauthenticated or authenticated user can abuse a page of AppBuilder to read arbitrary files on the server on which it is hosted. This issue affects AppBuilder: from 21.2 before 23.2. Vulnerabilidad de validación de entrada incorrecta, archivos o directorios accesibles a partes externas en OpenText AppBuilder en Windows, Linux permite sondear arc... • https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b • CWE-20: Improper Input Validation CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2024-23940
https://notcve.org/view.php?id=CVE-2024-23940
29 Jan 2024 — Trend Micro uiAirSupport, included in the Trend Micro Security 2023 family of consumer products, version 6.0.2092 and below is vulnerable to a DLL hijacking/proxying vulnerability, which if exploited could allow an attacker to impersonate and modify a library to execute code on the system and ultimately escalate privileges on an affected system. Trend Micro uiAirSupport, incluido en la familia de productos de consumo Trend Micro Security 2023, versión 6.0.2092 y anteriores, es vulnerable a una vulnerabilida... • https://helpcenter.trendmicro.com/en-us/article/tmka-12134 • CWE-427: Uncontrolled Search Path Element •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2024-23441 – Vba32 Antivirus v3.36.0 - Denial of Service (DoS)
https://notcve.org/view.php?id=CVE-2024-23441
29 Jan 2024 — Vba32 Antivirus v3.36.0 is vulnerable to a Denial of Service vulnerability by triggering the 0x2220A7 IOCTL code of the Vba32m64.sys driver. Vba32 Antivirus v3.36.0 es afectado por una vulnerabilidad de denegación de servicio al activar el código IOCTL 0x2220A7 del controlador Vba32m64.sys. • https://fluidattacks.com/advisories/rollins • CWE-125: Out-of-bounds Read CWE-400: Uncontrolled Resource Consumption CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-3181 – Insecure Permissions in Splashtop Software Updater
https://notcve.org/view.php?id=CVE-2023-3181
25 Jan 2024 — The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Temp~nsu.tmp and copies itself to it as Au_.exe. The C:\Windows\Temp~nsu.tmp\Au_.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI repair using Splashtop Streamer’s Windows Installer. Since the C:\Windows\Temp~nsu.tmp folder inherits permissions from C:\Windows\Temp and Au_.exe is susceptible to DLL hijacking, standard users can write a mali... • https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0015.md • CWE-379: Creation of Temporary File in Directory with Insecure Permissions •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-47141 – IBM Db2 denial of service
https://notcve.org/view.php?id=CVE-2023-47141
22 Jan 2024 — IIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 270264. IIBM Db2 para Linux, UNIX y Windows (incluye Db2 Connect Server) 11.5 podría permitir que un usuario autenticado con privilegios CONNECT provoque una denegación de servicio mediante una consulta especialmente manipulada. ID de IBM X-Force: 270264. • https://exchange.xforce.ibmcloud.com/vulnerabilities/270264 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2023-47158 – IBM Db2 denial of service
https://notcve.org/view.php?id=CVE-2023-47158
22 Jan 2024 — IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1 and 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 270750. IBM DB2 para Linux, UNIX y Windows (incluye Db2 Connect Server) 10.1, 10.5 y 11.1 podría permitir que un usuario autenticado con privilegios CONNECT provoque una denegación de servicio mediante una consulta especialmente manipulada. ID de IBM X-Force: 270750. • https://exchange.xforce.ibmcloud.com/vulnerabilities/270750 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-47152 – IBM Db2 information disclosure
https://notcve.org/view.php?id=CVE-2023-47152
22 Jan 2024 — IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions. IBM X-Force ID: 270730. IBM Db2 para Linux, UNIX y Windows (incluye Db2 Connect Server) 11.5 es vulnerable a un algoritmo criptográfico inseguro y a la divulgación de información en el seguimiento de la pila en condiciones excepcionales. ID de IBM X-Force: 270730. IBM Db2 for Linux, UNIX and Windows (includes Db... • https://exchange.xforce.ibmcloud.com/vulnerabilities/270730 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2023-27859 – IBM Db2 code execution
https://notcve.org/view.php?id=CVE-2023-27859
22 Jan 2024 — IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple databases. A user could exploit this by installing a malicious jar file that overwrites the existing like named jar file in another database. IBM X-Force ID: 249205. IBM Db2 10.1, 10.5 y 11.1 podría permitir que un usuario remoto ejecute código arbitrario causado por la instalación de archivos jar con nombres similares en múltiples bases de datos. Un usuario podría aprov... • https://exchange.xforce.ibmcloud.com/vulnerabilities/249205 •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2023-47747 – IBM Db2 denial of service
https://notcve.org/view.php?id=CVE-2023-47747
22 Jan 2024 — IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 272646. IBM DB2 para Linux, UNIX y Windows (incluye Db2 Connect Server) 10.1, 10.5 y 11.1 podría permitir que un usuario autenticado con privilegios CONNECT provoque una denegación de servicio mediante una consulta especialmente manipulada. ID de IBM X-Force: 272646. • https://exchange.xforce.ibmcloud.com/vulnerabilities/272646 • CWE-20: Improper Input Validation •