‼ CVE-2020-22656 ‼
📖 Read
via "National Vulnerability Database".
In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to make the Secure Boot in failed attempts state (rfwd).📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2020-22653 ‼
📖 Read
via "National Vulnerability Database".
In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to exploit the official image signature to force injection unauthorized image signature.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47021 ‼
📖 Read
via "National Vulnerability Database".
A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21152 ‼
📖 Read
via "National Vulnerability Database".
SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunction.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39193 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension can expose information on the performer of edits and logged actions. This information should not allow public viewing: it is supposed to be viewable only by users with checkuser access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24027 ‼
📖 Read
via "National Vulnerability Database".
In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24025 ‼
📖 Read
via "National Vulnerability Database".
CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may allow universal forgeries of digital signatures via a template side-channel attack because of intermediate data leakage of one vector.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23607 ‼
📖 Read
via "National Vulnerability Database".
erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to execute arbitrary code on the server. The file /www/include/filesave.php allows for any file to uploaded to anywhere. If an attacker uploads a php file they can execute code on the server. This issue has been addressed in version 1.05.00. Users are advised to upgrade. There are no known workarounds for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24026 ‼
📖 Read
via "National Vulnerability Database".
In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33642 ‼
📖 Read
via "National Vulnerability Database".
When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33641 ‼
📖 Read
via "National Vulnerability Database".
When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory (use after free).📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22726 ‼
📖 Read
via "National Vulnerability Database".
act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25502 ‼
📖 Read
via "National Vulnerability Database".
Cybereason EDR version 19.1.282 and above, 19.2.182 and above, 20.1.343 and above, and 20.2.X and above has a DLL hijacking vulnerability, which could allow a local attacker to execute code with elevated privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0052 ‼
📖 Read
via "National Vulnerability Database".
SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without credentials. As Telnet and file transfer protocol (FTP) are the only protocols available for device management, an unauthorized user could access the system and modify the device configuration, which could result in the unauthorized user executing unrestricted malicious commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24028 ‼
📖 Read
via "National Vulnerability Database".
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22884 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0433 ‼
📖 Read
via "National Vulnerability Database".
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.📖 Read
via "National Vulnerability Database".
👍1
📢 European partners expect growth this year, here are three ways they will achieve it 📢
📖 Read
via "ITPro".
It’s possible to achieve growth at a time of global economic turmoil, provided business objectives are fully aligned with the needs of customers📖 Read
via "ITPro".
ITPro
European partners expect growth this year, here are three ways they will achieve it
It’s possible to achieve growth at a time of global economic turmoil, provided business objectives are fully aligned with the needs of customers
👍1
📢 MSI to release securer BIOS settings after critical flaw discovered 📢
📖 Read
via "ITPro".
The firm has admitted it essentially disabled Secure Boot on its motherboards in an attempt to improve customisability📖 Read
via "ITPro".
ITPro
MSI to release securer BIOS settings after critical flaw discovered
The firm has admitted it essentially disabled Secure Boot on its motherboards in an attempt to improve customisability
📢 Windows 11 System Restore bug preventing users from accessing apps 📢
📖 Read
via "ITPro".
Microsoft has issued a series of workarounds for the issue which is affecting a range of apps including Office and Terminal📖 Read
via "ITPro".
ITPro
Windows 11 System Restore bug preventing users from accessing apps
Microsoft has issued a series of workarounds for the issue which is affecting a range of apps including Office and Terminal
📢 Royal Mail ransom note leaked, LockBit’s role remains uncertain 📢
📖 Read
via "ITPro".
The prolific ransomware operation has denied involvement but researchers remain sceptical📖 Read
via "ITPro".
ITPro
Royal Mail ransom note leaked, LockBit’s role remains uncertain
The prolific ransomware operation has denied involvement but researchers remain sceptical