‼ CVE-2023-23854 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-24525 ‼
📖 Read
via "National Vulnerability Database".
SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an authenticated attacker can cause limited impact on confidentiality of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23858 ‼
📖 Read
via "National Vulnerability Database".
Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to send a crafted URL to a user, and by clicking the URL, the tricked user accesses SAP and might be directed with the response to somewhere out-side SAP and enter sensitive data. This could cause a limited impact on confidentiality and integrity of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24524 ‼
📖 Read
via "National Vulnerability Database".
SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to delete the data with a high impact to availability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0814 ‼
📖 Read
via "National Vulnerability Database".
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22375 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** Cross-site request forgery (CSRF) vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker to hijack the authentication and conduct arbitrary operations by having a logged-in user to view a malicious page. NOTE: This vulnerability only affects products that are no longer supported by the developer.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23855 ‼
📖 Read
via "National Vulnerability Database".
SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation. A successful attack could lead an attacker to read or modify the information or expose the user to a phishing attack. As a result, it has a low impact to confidentiality, integrity and availability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22376 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** Reflected cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker to inject arbitrary script to inject an arbitrary script. NOTE: This vulnerability only affects products that are no longer supported by the developer.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25614 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow an unauthenticated attacker to inject the code that can be executed by the application over the network. On successful exploitation it can gain access to the sensitive information which leads to a limited impact on the confidentiality and the integrity of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0019 ‼
📖 Read
via "National Vulnerability Database".
In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24529 ‼
📖 Read
via "National Vulnerability Database".
Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a Reflected Cross-Site Scripting (XSS) attack. As a result, an attacker may be able to hijack a user session, read and modify some sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23859 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0655 ‼
📖 Read
via "National Vulnerability Database".
SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24187 ‼
📖 Read
via "National Vulnerability Database".
An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23851 ‼
📖 Read
via "National Vulnerability Database".
SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation. If other users visit the uploaded malicious web page, the attacker may perform actions on behalf of the users without their consent impacting the confidentiality and integrity of the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0024 ‼
📖 Read
via "National Vulnerability Database".
SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources, resulting in Cross-Site Scripting vulnerability.📖 Read
via "National Vulnerability Database".
⚠ Apple fixes zero-day spyware implant bug – patch now! ⚠
📖 Read
via "Naked Security".
Everyone update now! Except for those who don't need to! Or who need to but will only get updates later on, though Apple isn't saying yet!📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2023-24562 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been identified in Solid Edge SE2022 (All versions < V2210Update12), Solid Edge SE2023 (All versions < V2023Update2). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24560 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been identified in Solid Edge SE2022 (All versions < V2210Update12), Solid Edge SE2023 (All versions < V2023Update2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR file. This could allow an attacker to to execute code in the context of the current process.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24382 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24985 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19807)📖 Read
via "National Vulnerability Database".