Security Vulnerabilities - CVEs Published In June 2023
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
CVSS Score
7.5
EPSS Score
0.002
Published
2023-06-30
In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.
CVSS Score
5.4
EPSS Score
0.001
Published
2023-06-30
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.
CVSS Score
7.0
EPSS Score
0.002
Published
2023-06-30
angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.
CVSS Score
6.1
EPSS Score
0.003
Published
2023-06-30
Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model.
CVSS Score
9.8
EPSS Score
0.02
Published
2023-06-30
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Denial of Service when using the backup & restore feature through the embedded web service on the device.
CVSS Score
8.8
EPSS Score
0.003
Published
2023-06-30
Certain HP LaserJet Pro print products are potentially vulnerable to a stack-based buffer overflow related to the compact font format parser.
CVSS Score
8.8
EPSS Score
0.002
Published
2023-06-30
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow when performing a GET request to scan jobs.
CVSS Score
8.8
EPSS Score
0.002
Published
2023-06-30
Joplin before 2.11.5 allows XSS via a USE element in an SVG document.
CVSS Score
6.1
EPSS Score
0.002
Published
2023-06-30
Joplin before 2.11.5 allows XSS via an AREA element of an image map.
CVSS Score
6.1
EPSS Score
0.002
Published
2023-06-30