Mindbreeze InSpire Vulnerabilities
This page lists known security vulnerabilities found in Mindbreeze InSpire. The article titles contain the Mindbreeze issue number and, in the case of third-party software, the official CVE number. Information about the affected components, severity level, current status and how to prevent the issue as well as hotfix information if applicable, can be found on the detail pages. You can also use the full text search to find specific vulnerabilities.
If you have found a possible security vulnerability, please contact Mindbreeze InSpire Support at support@mindbreeze.com providing detailed information about the problem found.
Vulnerabilities
ID: MINDBREEZE30280 Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS Severity: 7.2 High Status: Final First published: March 18, 2024 CVEs: CVE-2024-1060 CVE-2024-1077 CVE-2024-1284 CVE-2024-1283 CVE-2024-1669 CVE-2024-1670 CVE-2024-1671 CVE-2024-1672 CVE-2024-1674 CVE-2024-1676 SummarySecurity Update Chromium Component
ID: MINDBREEZE30001 Affected Components: Mindbreeze InSpire, Mindbreeze InSpire SaaS Severity: 5.9 Medium Status: Final First published: March 18, 2024 CVEs: CVE-2023-52323 Summarypycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex Hotfix InformationFixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS: Mindbreeze InSpire 24.1 Release Mindbreeze InSpire SaaS 24.1 Release
ID: MINDBREEZE29950 Affected Components: Mindbreeze InSpire, Mindbreeze InSpire SaaS Severity: 8.8 High Status: Final First published: March 18, 2024 CVEs: CVE-2023-7024 CVE-2024-0222 CVE-2024-0223 CVE-2024-0224 CVE-2023-7024 CVE-2024-0807 CVE-2024-0812 CVE-2024-0808 CVE-2024-0810 CVE-2024-0517 CVE-2024-0518 CVE-2024-0519 SummarySecurity Update Chromium Component
ID: MINDBREEZE29867 Affected Components: Mindbreeze InSpire, Mindbreeze InSpire SaaS Severity: 5.4 Medium Status: Final Last Update: February 2, 2024 First published: March 18, 2024 CVEs: CVE-2023-6134 SummaryKeycloak - vulnerable to reflected XSS via wildcard in OIDC redirect_uri Hotfix InformationFixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS: Mindbreeze InSpire 24.1 Release Mindbreeze InSpire SaaS 24.1 Release
ID: MINDBREEZE29833 Affected Components: Mindbreeze InSpire, Mindbreeze InSpire SaaS Severity: 8.4 High Status: Final First published: March 18, 2024 CVEs: CVE-2023-48795, CVE-2023-6246, CVE-2023-6779, CVE-2023-6780, CVE-2023-50495, CVE-2023-6111, CVE-2023-2602, CVE-2023-2603, CVE-2023-48795, CVE-2023-51385
ID: MINDBREEZE29751 Affected Components: Mindbreeze InSpire G7 with active Kerberos client authentication Severity: Critical Status: Final First published: December 18, 2023 CVEs: MINDBREEZE29751
ID: MINDBREEZE29591 Affected Components: Mindbreeze InSpire, Mindbreeze InSpire SaaS Severity: 8.4 High Status: Final First published: February 8, 2024 CVEs: CVE-2023-5996 CVE-2023-6348 CVE-2023-6347 CVE-2023-6346 CVE-2023-6350 CVE-2023-6351 CVE-2023-6345 CVE-2023-6508 CVE-2023-6511 CVE-2023-6512 CVE-2023-6702 CVE-2023-6703 CVE-2023-6704 CVE-2023-6705 CVE-2023-6707 SummarySecurity Update Chromium Component
ID: MINDBREEZE29501 Affected Components: Mindbreeze InSpire, Mindbreeze InSpire SaaS Severity: 7.8 High Status: Final First published: February 8, 2024 CVEs: CVE-2023-5345, CVE-2023-42754, CVE-2023-42756 Summaryuse-after-free vulnerability in the smb client component NULL pointer dereference in ipv4_send_dest_unreach() race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP Hotfix InformationFixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
ID: MINDBREEZE29381 Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS Severity: 6.5 Medium Status: Final First published: March 18, 2024 CVEs: CVE-2023-44483 SummaryCVE-2023-44483 Private keys may be exposed in debug-level log files during XML Signature generation Hotfix InformationFixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS: Mindbreeze InSpire 24.1 Release Mindbreeze InSpire SaaS 24.1 Release
ID: MINDBREEZE29369 Affected Components: Mindbreeze InSpire, Mindbreeze InSpire SaaS Severity: 5.4 Medium Status: Final First published: November 29, 2023 CVEs: MINDBREEZE29369 SummaryXSS in app.telemetry Hotfix InformationFixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS: Mindbreeze InSpire 23.6 HF2 Release Mindbreeze InSpire SaaS 23.6 HF2 Release