zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c.

`lexical` contains multiple soundness issues:

 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)
 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)
 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)
 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)
1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126)

The crate also has some correctness issues.

## Alternatives

For quickly parsing floating-point numbers third-party crates are no longer needed. A fast float parsing algorithm by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore.

For quickly parsing integers, consider `atoi` and `btoi` crates (100% safe code). `atoi_radix10` provides even faster parsing, but only with `-C target-cpu=native`, and at the cost of some `unsafe`.

For formatting integers in a `#[no_std]` context consider the [`numtoa`](https://crates.io/crates/numtoa) crate.

For working with big numbers consider `num-bigint` and `num-traits`.


A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.

An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism.

Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.

A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and execute arbitrary commands.

This crate was part of a typosquatting malware cluster published by the user
`Kraded` to run an arbitrary malware payload on Windows hosts.

This advisory is to retrospectively document this attempted attack. The version
information and download records of the malicious crate are no longer
available. The related malicious crates have been yanked, and the malicious
account has been banned.

Panic when handling invalid HAProxy PROXY v2 request in github.com/mastercactapus/proxyprotocol

Stored cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.

The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account.

Paranoidhttp before is vulnerable to SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.20 or apply this patch manually https://github.com/pimcore/pimcore/pull/14721.patch

### Workarounds
Apply patch manually https://github.com/pimcore/pimcore/pull/14721.patch

### References
https://huntr.dev/bounties/d8a47f29-3297-4fce-b534-e1d95a2b3e19


Veilid before 0.1.9 does not check the size of uncompressed data during decompression upon an envelope receipt, which allows remote attackers to cause a denial of service (out-of-memory abort) via crafted packet data, as exploited in the wild in August 2023.

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.

### Impact

A vulnerability CVE-2023-39325 exists in [Go managing HTTP/2 requests](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ?pli=1), which impacts Traefik. This vulnerability could be exploited to cause a denial of service.

### References

- [CVE-2023-44487](https://www.cve.org/CVERecord?id=CVE-2023-44487)
- [CVE-2023-39325](https://www.cve.org/CVERecord?id=CVE-2023-39325)

### Patches

- https://github.com/traefik/traefik/releases/tag/v2.10.5
- https://github.com/traefik/traefik/releases/tag/v3.0.0-beta4

xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE).

### Impact
When the exponent is bigger than `r`, the group order of the pairing target group `GT`, the exponentiation à la GLV (`ExpGLV`) can *sometimes* give incorrect results compared to normal exponentiation (`Exp`). 

The issue impacts all users using `ExpGLV` for exponentiations in `GT`. This does not impact `Exp` and `ExpCyclotomic` which are sound. Also note that GLV methods in G1 and G2 are sound and _not_ impacted.

### Patches
Fix has been implemented in pull request https://github.com/Consensys/gnark-crypto/pull/451 and merged in commit https://github.com/Consensys/gnark-crypto/commit/ec6be1a037f7c496d595c541a8a8d31c47bcfa3d to master branch.

The fix increased the bounds of the sub-scalars by 1. In fact, since https://github.com/Consensys/gnark-crypto/pull/213, we use a fast scalar decomposition that tradeoffs divisions (needed in the Babai rounding) by right-shifts. We precompute `b=2^m*v/d (m > log2(d))` and then at runtime compute `scalar*b/2^m` (`v` is a lattice vector and `d` the lattice determinant). This increases the bounds on sub-scalars by 1 which we check at runtime before increasing the loop size (we don't target constant-timeness). `m` is chosen to be a machine word twice big than `log2(d)` so that we rarely need to increase the loop size. Hence why the issue happens only *sometimes* if we omit to increase the bounds. This bounds increase was implemented in G1 and G2 but forgot in GT.

### Workarounds
Updating to `v0.12.1+`. Alternatively, use `Exp` or `ExpCyclotomic` instead. We are not aware of any users using `ExpGLV` anyway.

### References
- Fix PR: https://github.com/Consensys/gnark-crypto/pull/451 
- Fast scalar decomposition PR: https://github.com/Consensys/gnark-crypto/pull/213
- https://eprint.iacr.org/2015/565 Sec.4.2

### Acknowledgement
The vulnerability was reported by [Antonio Sanso](https://github.com/asanso) @ [EF](https://crypto.ethereum.org/).


The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files.

This release was coordinated with [SA-CONTRIB-2023-010](https://www.drupal.org/sa-contrib-2023-010).

This advisory is not covered by [Drupal Steward](/steward).

Null pointer dereference in paddle.flip in PaddlePaddle before 2.5.0. This resulted in a runtime crash and denial of service.


Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.

The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel.

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.

Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init.

A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

A vulnerability, which was classified as problematic, was found in kakwa LdapCherry up to 0.x. Affected is an unknown function of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The name of the patch is 6f98076281e9452fdb1adcd1bcbb70a6f968ade9. It is recommended to upgrade the affected component. VDB-217434 is the identifier assigned to this vulnerability.

read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.

C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c.

File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function.

**Component**: Cosmovisor
**Criticality**: Medium
**Affected Versions**: Cosmovisor < v1.0.0 (distributed with Cosmos-SDK < 0.46)
**Affected Users**: Validators and Node operators utilizing unsupported versions of Cosmovisor
**Impact**: DOS, potential RCE on node depending on configuration


An issue has been identified on unsupported versions of Cosmovisor which may result in a Denial of Service or Remote Code Execution path depending on configuration for a node or validator using the vulnerable version to manage their node. 

If a validator is utilizing an affected version of Cosmovisor with `DAEMON_ALLOW_DOWNLOAD_BINARIES` set to true, a non-default configuration, it may be possible for an attacker to trigger a Remote Code Execution path as well on the host. In this configuration it is recommended to immediately stop use of the `DAEMON_ALLOW_DOWNLOAD_BINARIES` feature, and then proceed with an upgrade of Cosmovisor.

It is recommended that all validators utilizing unsupported versions of Cosmovisor to upgrade to the latest supported versions immediately.  If you are utilizing a forked version of Cosmos-SDK, it is recommended to stop use of Cosmovisor until it is possible to update to a supported version of Cosmovisor, whether through your project’s fork, or directly compiled from the Cosmos-SDK. At the time of this advisory, the latest version of Cosmovisor is v1.5.0. 

Additionally, the Amulet team recommends that developers building chains powered by Cosmos-SDK share this advisory with validators and node operators to ensure this information is available to all impacted parties within their ecosystems.

For more information about Cosmovisor, see https://docs.cosmos.network/main/tooling/cosmovisor

This issue was discovered by [Maxwell Dulin](https://maxwelldulin.com) and Nathan Kirkland, who reported it to the Cosmos Bug Bounty Program.  If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see [https://hackerone.com/cosmos](https://hackerone.com/cosmos).

## How to tell if I am affected?

Running the following command will output whether your cosmovisor version is vulnerable to this issue or not.  

Vulnerable to this issue: 

```
strings ./cosmovisor | grep -q "NEEDED at" && echo "vulnerable" || echo "NOT vulnerable"

vulnerable
```


NOT vulnerable to this issue:

```
strings ./cosmovisor_new | grep -q "NEEDED at" && echo "vulnerable" || echo "NOT vulnerable"

NOT vulnerable
```


*****

A Note from Amulet on the Security Advisory Process

In the interest of timely resolution of this issue for validators and node operators, the Amulet team has chosen to use existing processes and resources for distributing security advisories within the Cosmos and Interchain Ecosystems. Stay tuned as we implement an improved, more robust security advisory distribution system that will provide equitable access to information about security issues in the Interchain Stack.


In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section.

app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.

OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp parameter within the /QueryView.php.

In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.

A path traversal vulnerability exists in filepath.Clean on Windows.

On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack.

After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.

The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption.

An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function.

# x/crisis does not charge ConstantFee
### Impact
If a transaction is sent to the `x/crisis` module to check an invariant, the ConstantFee parameter of the chain is NOT charged. All versions of the `x/crisis` module are affected on all versions of the Cosmos SDK.

### Details
The `x/crisis` module is supposed to allow anyone to halt a chain in the event of a violated invariant by sending a `MsgVerifyInvariant` with the name of the invariant. Processing this message takes extra processing power hence a `ConstantFee` was introduced on the chain that is charged as extra from the reporter for the extra computational work. This is supposed to avert spammers on the chain making nodes do extra computations using this transaction. By not charging the `ConstantFee`, the transactions related to invariant checking are relatively cheaper compared to the computational need and other transactions.

That said, the submitter still has to pay the transaction fee to put the transaction on the network, hence using this weakness for spamming is limited by the usual mechanisms.

Synthetic testing showed up to a 20% increase in CPU usage on a validator node that is spammed by hundreds of `MsgVerifyInvariant` messages which still makes this an expensive operation to carry out on a live blockchain network.

### Patches
The `ConstantFee` charge of the `x/crisis` module will either be fixed or disabled in an upcoming regular release of the Cosmos SDK.

The `x/crisis` module was originally intended to allow chains to halt rather than continue with some unknown behavior in the case of an invariant violation (safety over liveness). However, as chains mature, and especially as the potential [cost of halting increases](https://github.com/osmosis-labs/osmosis/issues/570), chains should consider carefully what invariants they really want to halt for, and what invariants are just sort of helpful sanity checks.

The SDK team is working on new modules that allow chain developers to fine-tune the chain invariants and the necessary actions.

Hence, the decision was made that the `x/crisis` module will be deprecated when new modules take over its responsibilities.

### Workarounds
There is no workaround posted. Validators are advised to leave some extra computing room on their servers for possible spamming scenarios. (This is a good measure in any case.)

### References
SDK developer epic about invariant checking: https://github.com/cosmos/cosmos-sdk/issues/15706


A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.

OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user.

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-6qjm-39vh-729w](https://github.com/advisories/GHSA-6qjm-39vh-729w). This link is maintained ot preserve external references.

## Original Description
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.

The latest crates.io release was in 2019. The repository has been archived by the author.

## Migration

- `safemem::copy_over(slice, src_idx, dest_idx, len);` can be replaced with `slice.copy_within(src_idx..src_idx+len, dest_idx);` as of `rust 1.37.0`.
- `safemem::write_bytes(slice, byte);` can be replaced with `slice.fill(byte);` as of `rust 1.50.0`
- `safemem::prepend(slice, vec);` can be replaced with

  ```rust
  let old_len = vec.len();
  vec.extend_from_slice(slice);
  vec.rotate_left(old_len);
  ```
  
  as of `rust 1.26.0`

Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.

Denial of service via deflate compression bomb in github.com/crewjam/saml

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.
 
Update to Apache Spark 3.4.0 or later, and ensure that 
spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its 
default of "false", and is not overridden by submitted applications.




Low-privileged users can set the seccomp profile for pods they control to "unconfined."

By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.

A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path.

A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQL Injection.

CVE ID↕	Published↕	CVSS↓
DLA-3441-1	Jun 2, 2023	N/A
CVE-2023-46228	Oct 19, 2023	N/A
GHSA-c2hm-mjxv-89r4	Sep 4, 2023	N/A
CVE-2023-1289	Mar 23, 2023	N/A
DLA-3326-1	Feb 20, 2023	N/A
CVE-2023-39069	Sep 11, 2023	N/A
DLA-3390-1	Apr 12, 2023	N/A
DLA-3494-1	Jul 12, 2023	N/A
CVE-2023-44761	Oct 6, 2023	N/A
CVE-2023-38874	Sep 28, 2023	N/A
DLA-3453-1	Jun 12, 2023	N/A
DLA-3407-1	Apr 30, 2023	N/A
RUSTSEC-2023-0109	Nov 15, 2023	N/A
GO-2023-1923	Jul 25, 2023	N/A
CVE-2023-38569	Sep 5, 2023	N/A
CVE-2023-36487	Jun 29, 2023	N/A
GO-2023-1526	Feb 14, 2023	N/A
GHSA-6qjm-39vh-729w	Mar 31, 2023	N/A
CVE-2023-40711	Aug 20, 2023	N/A
CVE-2023-49373	Dec 5, 2023	N/A
GHSA-7v4p-328v-8v5g	Oct 17, 2023	N/A
CVE-2023-37659	Jul 11, 2023	N/A
DSA-5440-1	Jun 28, 2023	N/A
GHSA-pffg-92cg-xf5c	Oct 5, 2023	N/A
DRUPAL-CORE-2023-002	Mar 15, 2023	N/A
DLA-3365-1	Mar 20, 2023	N/A
PYSEC-2023-123	Jul 26, 2023	N/A
PYSEC-2023-34	Apr 18, 2023	N/A
CVE-2023-36211	Aug 1, 2023	N/A
GHSA-8849-cv9f-vccm	Apr 26, 2023	N/A
CVE-2023-49935	Dec 14, 2023	N/A
CVE-2023-39013	Jul 28, 2023	N/A
DLA-3581-1	Sep 25, 2023	N/A
CVE-2023-33797	May 24, 2023	N/A
PYSEC-2023-19	Jan 5, 2023	N/A
CVE-2022-48564	Aug 22, 2023	N/A
CVE-2023-37188	Dec 25, 2023	N/A
DSA-5370-1	Mar 7, 2023	N/A
DSA-5447-1	Jul 5, 2023	N/A
CVE-2023-44008	Oct 2, 2023	N/A
GHSA-23px-mw2p-46qm	Sep 6, 2023	N/A
CVE-2023-35853	Jun 19, 2023	N/A
CVE-2023-24070	Jan 23, 2023	N/A
DSA-5332-1	Jan 29, 2023	N/A
CVE-2022-44570	Feb 9, 2023	N/A
PYSEC-2023-39	Feb 3, 2023	N/A
PYSEC-2023-57	Feb 14, 2023	N/A
CVE-2023-38771	Aug 8, 2023	N/A
CVE-2023-33264	May 22, 2023	N/A
CVE-2023-49395	Dec 5, 2023	N/A
GO-2023-1568	Feb 16, 2023	N/A
CVE-2023-48967	Dec 4, 2023	N/A
DSA-5470-1	Aug 6, 2023	N/A
GO-2023-2379	Dec 11, 2023	N/A
GHSA-392h-r46j-q24p	Nov 28, 2023	N/A
GHSA-w5w5-2882-47pc	Jun 30, 2023	N/A
CVE-2023-2283	May 26, 2023	N/A
CVE-2023-24598	May 29, 2023	N/A
CVE-2023-39137	Aug 30, 2023	N/A
DLA-3454-1	Jun 13, 2023	N/A
GHSA-69fc-v223-6rjw	Mar 29, 2023	N/A
RUSTSEC-2023-0081	Feb 14, 2023	N/A
DLA-3291-1	Jan 29, 2023	N/A
DSA-5380-1	Mar 29, 2023	N/A
CVE-2023-45884	Nov 9, 2023	N/A
DSA-5417-1	May 31, 2023	N/A
DSA-5500-1	Sep 18, 2023	N/A
DLA-3311-1	Feb 8, 2023	N/A
DLA-3264-1	Jan 10, 2023	N/A
DLA-3357-1	Mar 11, 2023	N/A
GO-2023-1664	Aug 23, 2023	N/A
PYSEC-2023-44	Apr 17, 2023	N/A
GO-2023-1549	Feb 16, 2023	N/A
CVE-2023-39000	Aug 9, 2023	N/A
CVE-2023-38870	Sep 28, 2023	N/A

Know every vulnerability
before it knows you.

2023 CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

2023 CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.