‼ CVE-2023-0379 ‼
📖 Read
via "National Vulnerability Database".
The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4445 ‼
📖 Read
via "National Vulnerability Database".
The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0275 ‼
📖 Read
via "National Vulnerability Database".
The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0405 ‼
📖 Read
via "National Vulnerability Database".
The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts.📖 Read
via "National Vulnerability Database".
⚠ Serious Security: GnuTLS follows OpenSSL, fixes timing attack bug ⚠
📖 Read
via "Naked Security".
Conditional code considered cryptographically counterproductive.📖 Read
via "Naked Security".
Naked Security
Serious Security: GnuTLS follows OpenSSL, fixes timing attack bug
Conditional code considered cryptographically counterproductive.
‼ CVE-2022-41134 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22854 ‼
📖 Read
via "National Vulnerability Database".
The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due to insufficient restriction of URL parameters. A successful exploit could allow access to sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48077 ‼
📖 Read
via "National Vulnerability Database".
Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.📖 Read
via "National Vulnerability Database".
🔥1
‼ CVE-2023-23553 ‼
📖 Read
via "National Vulnerability Database".
Control By Web X-400 devices are vulnerable to a cross-site scripting attack, which could result in private and session information being transferred to the attacker.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3089 ‼
📖 Read
via "National Vulnerability Database".
Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials could be used to control the web user interface and file transfer protocol (FTP) server.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23948 ‼
📖 Read
via "National Vulnerability Database".
The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in `FileContentProvider.kt`. This issue can lead to information disclosure. Two databases, `filelist` and `owncloud_database`, are affected. In version 3.0, the `filelist` database was deprecated. However, injections affecting `owncloud_database` remain relevant as of version 3.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25159 ‼
📖 Read
via "National Vulnerability Database".
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform. Nextcloud Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, Nextcloud Enterprise Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, and Nextcloud Office (Richdocuments) App 6.x prior to 6.3.1 and 7.x prior to 7.0.1 have previews accessible without a watermark. The download should be hidden and the watermark should get applied. This issue is fixed in Nextcloud Server 25.0.1 and 24.0.8, Nextcloud Enterprise Server 25.0.1 and 24.0.8, and Nextcloud Office (Richdocuments) App 7.0.1 (for 25) and 6.3.1 (for 24). No known workarounds are available.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24804 ‼
📖 Read
via "National Vulnerability Database".
The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. The bypasses may lead to information disclosure when uploading the app’s internal files, and to arbitrary file write when uploading plain text files (although limited by the .txt extension). Version 3.0 fixes the reported bypasses.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23551 ‼
📖 Read
via "National Vulnerability Database".
Control By Web X-600M devices run Lua scripts and are vulnerable to code injection, which could allow an attacker to remotely execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0810 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11.📖 Read
via "National Vulnerability Database".
🕴 Russian Hackers Disrupt NATO Earthquake Relief Operations 🕴
📖 Read
via "Dark Reading".
Killnet claims DDoS attack against NATO Special Operations Headquarters, Strategic Airlift Capability, and more.📖 Read
via "Dark Reading".
Dark Reading
Russian Hackers Disrupt NATO Earthquake Relief Operations
Killnet claims DDoS attack against NATO Special Operations Headquarters, Strategic Airlift Capability, and more.
🕴 Healthcare in the Crosshairs of North Korean Cyber Operations 🕴
📖 Read
via "Dark Reading".
CISA, FBI, and South Korean intelligence agencies warn that the North Korean government is sponsoring ransomware attacks to fund its cyber-espionage activities.📖 Read
via "Dark Reading".
Dark Reading
Healthcare in the Crosshairs of North Korean Cyber Operations
CISA, FBI, and South Korean intelligence agencies warn that the North Korean government is sponsoring ransomware attacks to fund its cyber-espionage activities.
‼ CVE-2023-24619 ‼
📖 Read
via "National Vulnerability Database".
Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versions are 22.3.12, 22.2.10, and 22.1.12.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48110 ‼
📖 Read
via "National Vulnerability Database".
CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25719 ‼
📖 Read
via "National Vulnerability Database".
ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded executable. The executable can be used to execute malicious queries or as a denial-of-service vector.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-45285 ‼
📖 Read
via "National Vulnerability Database".
Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS).📖 Read
via "National Vulnerability Database".