CVE-2023-26449
The “OX Chat” web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed […]
İçeriği inceleyinALLSAFE / Güncel Güvenlik Açıkları
Güvenlik Açıkları
NIST NVD, USOM / Siber Güvenlik Başkanlığı ve Exploit-DB kaynaklarından güvenlik bildirimleri. Etkilenen ürün ve sürümleri özgün kaynakta doğrulayın.
Kayıtlar kaynakların yayın tarihleri ve özgün içerikleriyle sunulur. Bir kaydın bulunması, kurumunuzun etkilendiğini tek başına göstermez. Sürüm ve yapılandırmayı kontrol ederek üreticinin güncel önerilerini değerlendirin.
CVE-2023-26450
The “OX Count” web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed […]
İçeriği inceleyinCVE-2023-26451
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third […]
İçeriği inceleyinCVE-2023-26430
Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE […]
İçeriği inceleyinCVE-2023-26438
External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers that […]
İçeriği inceleyinCVE-2023-26439
The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. […]
İçeriği inceleyinCVE-2023-26440
The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed […]
İçeriği inceleyinCVE-2023-26441
Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with […]
İçeriği inceleyinCVE-2023-26442
In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker […]
İçeriği inceleyinCVE-2023-26443
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused […]
İçeriği inceleyinCVE-2023-26445
Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script […]
İçeriği inceleyinCVE-2023-26446
The users clientID at “application passwords” was not sanitized or escaped before being added to DOM. Malicious script code can be executed […]
İçeriği inceleyin