CVE-2023-4760

Remote Code Execution in Eclipse RAP on Windows

In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileName(String name) method. As soon as this finds a / in the path, everything before it is removed, but potentially \ (backslashes) coming further back are kept. For example, a file name such as /..\..\webapps\shell.war can be used to upload a file to a Tomcat server under Windows, which is then saved as ..\..\webapps\shell.war in its webapps directory and can then be executed.

CVSS 3.1 · 7.6 High EPSS 1.2% KEV · Not listed

Vendors

Eclipse

Products

Remote Application Platform

CVE-2023-4759

Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write

Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem. This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command. The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration. Setting git configuration option core.symlinks = false before checking out avoids the problem. The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/  and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from 5.13.3.202401111512-r. The JGit maintainers would like to thank RyotaK for finding and reporting this issue.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed

Vendors

Apple Eclipse Microsoft and 1 more

Products

Macos Jgit Windows and 1 more

CVE-2023-4758

Buffer Over-read in gpac/gpac

Buffer Over-read in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2023-4756

Stack-based Buffer Overflow in gpac/gpac

Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2023-4755

Use After Free in gpac/gpac

Use After Free in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2023-4754

Out-of-bounds Write in gpac/gpac

Out-of-bounds Write in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2023-4753

OpenHarmony v3.2.1 and prior version has a system call function usage error

OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2023-4749

SourceCodester Inventory Management System index.php file inclusion

A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to file inclusion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238638 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Inventory Management System

CVE-2023-4748

Yongyou UFIDA-NC PrintTemplateFileServlet.java path traversal

A vulnerability, which was classified as critical, has been found in Yongyou UFIDA-NC up to 20230807. This issue affects some unknown processing of the file PrintTemplateFileServlet.java. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238637 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Yonyou

Products

Ufida-nc

CVE-2023-4747

DedeCMS tags.php sql injection

A vulnerability classified as critical was found in DedeCMS 5.7.110. This vulnerability affects unknown code of the file /uploads/tags.php. The manipulation of the argument tag_alias leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238636.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dedecms

Products

Dedecms

CVE-2023-4746

TOTOLINK N200RE V5 Validity_check format string

A vulnerability classified as critical has been found in TOTOLINK N200RE V5 9.3.5u.6437_B20230519. This affects the function Validity_check. The manipulation leads to format string. It is possible to initiate the attack remotely. The root-cause of the vulnerability is a format string issue. But the impact is to bypass the validation which leads to to OS command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238635.

CVSS 3.1 · 8.8 High EPSS 3.7% KEV · Not listed

Vendors

Totolink

Products

N200re-v5 N200re-v5 Firmware

CVE-2023-4745

Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php sql injection

A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230822. It has been rated as critical. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-238634 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Byzoro

Products

Smart S45f Smart S45f Firmware

CVE-2023-4744

Tenda AC8 formSetDeviceName stack-based overflow

A vulnerability was found in Tenda AC8 16.03.34.06_cn_TDC01. It has been declared as critical. Affected by this vulnerability is the function formSetDeviceName. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238633 was assigned to this vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed

Vendors

Tenda

Products

Ac8 Ac8 Firmware

CVE-2023-4742

IBOS OA export&uid=X sql injection

A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=dashboard/user/export&uid=X. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238631. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibos

Products

Ibos

CVE-2023-4741

IBOS OA Delete Logs del sql injection

A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects unknown code of the file ?r=diary/default/del of the component Delete Logs Handler. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-238630 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibos

Products

Ibos

CVE-2023-4722

Integer Overflow or Wraparound in gpac/gpac

Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2023-4721

Out-of-bounds Read in gpac/gpac

Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2023-4720

Floating Point Comparison with Incorrect Operator in gpac/gpac

Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2023-4714

PlayTube Redirect information disclosure

A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. The identifier VDB-238577 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS 5.5% KEV · Not listed

Vendors

Playtube

Products

Playtube

CVE-2023-4713

IBOS OA addcomment addComment sql injection

A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function addComment of the file ?r=weibo/comment/addcomment. The manipulation of the argument touid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238576. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibos

Products

Ibos