CVE-2023-20852
published 2023-04-27CVE-2023-20852: aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit…
PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.99%
58.0th percentile
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aenrich | a+hrd | — | — |
| aenrich | a_+hrd | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wcmw-fjqp-gpmg: aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter
ghsa_unreviewed·2023-04-27
CVE-2023-20852 [CRITICAL] CWE-502 GHSA-wcmw-fjqp-gpmg: aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service.
Red Hat
bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability
vendor_redhat·2024-05-03·CVSS 5.7
CVE-2023-51580 [MEDIUM] CWE-125 bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability
bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability
BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.
The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20852.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-04-27
Published