‼ CVE-2023-23847 ‼
📖 Read
via "National Vulnerability Database".
A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23466 ‼
📖 Read
via "National Vulnerability Database".
Media CP Media Control Panel latest version. Insufficiently protected credential change.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23458 ‼
📖 Read
via "National Vulnerability Database".
Sunell DVR, latest version, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor through an unspecified request.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23464 ‼
📖 Read
via "National Vulnerability Database".
Media CP Media Control Panel latest version. A Permissive Flash Cross-domain Policy may allow information disclosure.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-23850 ‼
📖 Read
via "National Vulnerability Database".
A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47507 ‼
📖 Read
via "National Vulnerability Database".
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23461 ‼
📖 Read
via "National Vulnerability Database".
Libpeconv – access violation, before commit b076013 (30/11/2022).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47508 ‼
📖 Read
via "National Vulnerability Database".
Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were querying for data via IP address this prevented us from utilizing Kerberos.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23460 ‼
📖 Read
via "National Vulnerability Database".
Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24498 ‼
📖 Read
via "National Vulnerability Database".
An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config page with the password to the switch in clear text.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23467 ‼
📖 Read
via "National Vulnerability Database".
Media CP Media Control Panel latest version. Reflected XSS possible through unspecified endpoint.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23836 ‼
📖 Read
via "National Vulnerability Database".
SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to the SolarWinds Web Console to execute arbitrary commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23462 ‼
📖 Read
via "National Vulnerability Database".
Libpeconv – integer overflow, before commit 75b1565 (30/11/2022).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47503 ‼
📖 Read
via "National Vulnerability Database".
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47504 ‼
📖 Read
via "National Vulnerability Database".
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24499 ‼
📖 Read
via "National Vulnerability Database".
Butterfly Button plugin may leave traces of its use on user's device. Since it is used for reporting domestic problems, this may lead to spouse knowing about its use.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38111 ‼
📖 Read
via "National Vulnerability Database".
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47506 ‼
📖 Read
via "National Vulnerability Database".
SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticated account access to edit the default configuration, enabling the execution of arbitrary commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23848 ‼
📖 Read
via "National Vulnerability Database".
Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.📖 Read
via "National Vulnerability Database".
🕴 ChatGPT Subs In as Security Analyst, Hallucinates Only Occasionally 🕴
📖 Read
via "Dark Reading".
Incident response triage and software vulnerability discovery are two areas where the large language model has demonstrated success, although false positives are common.📖 Read
via "Dark Reading".
Dark Reading
ChatGPT Subs In as Security Analyst, Hallucinates Only Occasionally
Incident response triage and software vulnerability discovery are two areas where the large language model has demonstrated success, although false positives are common.
‼ CVE-2023-22855 ‼
📖 Read
via "National Vulnerability Database".
Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllable path is handed to a path-concatenation method (Path.Combine from .NET) without proper sanitisation. This yields the possibility of including local files, as well as remote files on SMB shares. If one provides a file with the extension .t4, it is rendered with the .NET templating engine mono/t4, which can execute code.📖 Read
via "National Vulnerability Database".