First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-4778

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
gpac	gpac/gpac	>= unspecified, < 2.3-DEV

References

https://github.com/gpac/gpac/commit/d553698050af478049e1a09e44a15ac884f223edPatch
https://huntr.dev/bounties/abb450fb-4ab2-49b0-90da-3d878eea5397Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/gpac/gpac/commit/d553698050af478049e1a09e44a15ac884f223edPatch
https://huntr.dev/bounties/abb450fb-4ab2-49b0-90da-3d878eea5397Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Sep 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-477804.3Missing Authorization vulnerability in flowdee EasyAzon easyazon allows Exploiting Incorrectly Configured Access Control Security Levels.Thi CVE-2023-477818.8Cross-Site Request Forgery (CSRF) vulnerability in Thrive Themes Thrive Theme Builder < 3.24.2 versions.CVE-2023-477828.8Improper Privilege Management vulnerability in Thrive Themes Thrive Theme Builder allows Privilege Escalation.This issue affects Thrive Them CVE-2023-477838.3Missing Authorization vulnerability in Thrive Themes Thrive Theme Builder.This issue affects Thrive Theme Builder: from n/a before 3.24.0.CVE-2023-477848.8Unrestricted Upload of File with Dangerous Type vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from CVE-2023-477858.8Cross-Site Request Forgery (CSRF) vulnerability in LayerSlider plugin <= 7.7.9 versions.CVE-2023-477865.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <= 7.7.9 versions.CVE-2023-477878.8Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a throug CVE-2023-477888.8Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7.CVE-2023-477898.8Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: f CVE-2023-47795.4The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versi CVE-2023-477906.1Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in Poporon Pz-LinkCard plugin <= 2.4.8 versions.