‼ CVE-2022-47130 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privileges interacts on the CSRF page.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25135 ‼
📖 Read
via "National Vulnerability Database".
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47131 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.📖 Read
via "National Vulnerability Database".
🔥1
‼ CVE-2023-23636 ‼
📖 Read
via "National Vulnerability Database".
In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25139 ‼
📖 Read
via "National Vulnerability Database".
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48074 ‼
📖 Read
via "National Vulnerability Database".
An issue in NoMachine before v8.2.3 allows attackers to execute arbitrary commands via a crafted .nxs file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25136 ‼
📖 Read
via "National Vulnerability Database".
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration; however, the vulnerability discoverer reports that "exploiting this vulnerability will not be easy."📖 Read
via "National Vulnerability Database".
🕴 MITRE Releases Tool to Design Cyber Resilient Systems 🕴
📖 Read
via "Dark Reading".
Engineers can use the Cyber Resiliency Engineering Framework Navigator to visuzalize their cyber resiliency capabilities.📖 Read
via "Dark Reading".
Dark Reading
MITRE Releases Tool to Design Cyber-Resilient Systems
Engineers can use the Cyber Resiliency Engineering Framework Navigator to visuzalize their cyber-resiliency capabilities.
🕴 How the Cloud Is Shifting CISO Priorities 🕴
📖 Read
via "Dark Reading".
The greatly expanding attack surface created by the cloud needs to be protected.📖 Read
via "Dark Reading".
Dark Reading
How the Cloud Is Shifting CISO Priorities
The greatly expanding attack surface created by the cloud needs to be protected.
🗓️ Serious security hole plugged in infosec tool binwalk 🗓️
📖 Read
via "The Daily Swig".
Path traversals could ‘void reverse engineering efforts and tamper with evidence collected’📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Serious security hole plugged in infosec tool binwalk
Path traversals could ‘void reverse engineering efforts and tamper with evidence collected’
‼ CVE-2023-24142 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24139 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24138 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24153 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24141 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24152 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24149 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /etc/shadow.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24151 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24150 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24144 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the setRebootScheCfg function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24140 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function.📖 Read
via "National Vulnerability Database".