CVE-2023-38335

Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed to be an irreversible operation. However, due to implementation issues, "always private" Omnis libraries can be opened by the Omnis Studio browser by bypassing specific checks. This violates the expected behavior of an "irreversible operation".

• CWE-276

• http://packetstormsecurity.com/files/173695/Omnis-Studio-10.22.00-Library-Setting-Bypass.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2023/Jul/41Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Jul/43Not Applicable
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-005.txtThird Party Advisory
• http://packetstormsecurity.com/files/173695/Omnis-Studio-10.22.00-Library-Setting-Bypass.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2023/Jul/41Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Jul/43Not Applicable
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-005.txtThird Party Advisory

Published

Jul 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3833A vulnerability was found in Bug Finder Montage 1.0. It has …6.1
• CVE-2023-38330OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 all…5.3
• CVE-2023-38331Zoho ManageEngine Support Center Plus 14001 and below is vul…5.4
• CVE-2023-38332Zoho ManageEngine ADManager Plus through 7201 allow authenti…6.5
• CVE-2023-38333Zoho ManageEngine Applications Manager through 16530 allows …6.1
• CVE-2023-38334Omnis Studio 10.22.00 has incorrect access control. It adver…6.5
• CVE-2023-38336netkit-rcp in rsh-client 0.17-24 allows command injection vi…9.8
• CVE-2023-38337rswag before 2.10.1 allows remote attackers to read arbitrar…7.5
• CVE-2023-3834A vulnerability was found in Bug Finder EX-RATE 1.0. It has …6.1
• CVE-2023-38343An XXE (XML external entity injection) vulnerability exists …7.5
• CVE-2023-38344An issue was discovered in Ivanti Endpoint Manager before 20…6.5
• CVE-2023-38346An issue was discovered in Wind River VxWorks 6.9 and 7. The…8.8