‼ CVE-2023-25928 ‼
📖 Read
via "National Vulnerability Database".
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 247646.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-45564 ‼
📖 Read
via "National Vulnerability Database".
SQL Injection vulnerability in znfit Home improvement ERP management system V50_20220207,v42 allows attackers to execute arbitrary sql commands via the userCode parameter to the wechat applet.📖 Read
via "National Vulnerability Database".
🕴 Insider Threats Don't Mean Insiders Are Threatening 🕴
📖 Read
via "Dark Reading".
By implementing tools that enable internal users to do their jobs efficiently and securely, companies reduce insider threat risk by building insider trust.📖 Read
via "Dark Reading".
Dark Reading
Insider Threats Don't Mean Insiders Are Threatening
By implementing tools that enable internal users to do their jobs efficiently and securely, companies reduce insider threat risk by building insider trust.
🗓️ CVSS system criticized for failure to address real-world impact 🗓️
📖 Read
via "The Daily Swig".
JFrog argues vulnerability risk metrics need complete revamp📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
CVSS system criticized for failure to address real-world impact
JFrog argues vulnerability risk metrics need complete revamp
⚠ GoDaddy admits: Crooks hit us with malware, poisoned customer websites ⚠
📖 Read
via "Naked Security".
New report admits that attackers were detected in the network about three months ago, and may have been attacking for about three years.📖 Read
via "Naked Security".
Naked Security
GoDaddy admits: Crooks hit us with malware, poisoned customer websites
New report admits that attackers were detected in the network about three months ago, and may have been attacking for about three years.
⚠ Twitter tells users: Pay up if you want to keep using insecure 2FA ⚠
📖 Read
via "Naked Security".
Ironically, Twitter Blue users will be allowed to keep using the very 2FA process that's not considered secure enough for everyone else.📖 Read
via "Naked Security".
Naked Security
Twitter tells users: Pay up if you want to keep using insecure 2FA
Ironically, Twitter Blue users will be allowed to keep using the very 2FA process that’s not considered secure enough for everyone else.
👍1
‼ CVE-2023-23009 ‼
📖 Read
via "National Vulnerability Database".
Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.📖 Read
via "National Vulnerability Database".
‼ CVE-2015-10084 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in irontec klear-library chloe and classified as critical. Affected by this issue is the function _prepareWhere of the file Controller/Rest/BaseController.php. The manipulation leads to sql injection. Upgrading to version marla is able to address this issue. The name of the patch is b25262de52fdaffde2a4434fc2a84408b304fbc5. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221504.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22984 ‼
📖 Read
via "National Vulnerability Database".
A Vulnerability was discovered in Axis 207W network camera. There is a reflected XSS vulnerability in the web administration portal, which allows an attacker to execute arbitrary JavaScript via URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22920 ‼
📖 Read
via "National Vulnerability Database".
A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfiguration intended for testing purposes. A remote attacker could leverage this vulnerability to access an affected device using Telnet.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0934 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.5.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32857 ‼
📖 Read
via "National Vulnerability Database".
Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32859 ‼
📖 Read
via "National Vulnerability Database".
The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view. Versions 1.0.14 and prior are prone to cross-site scripting (XSS) when handling untrusted `placeholder` entries. An attacker who is able to influence the field `placeholder` when creating a `Calendar` instance is able to supply arbitrary `html` or `javascript` that will be rendered in the context of a user leading to XSS. There are no known patches for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32861 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-32856. Reason: This candidate is a reservation duplicate of CVE-2021-32856. Notes: All CVE users should reference CVE-2021-32856 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32858 ‼
📖 Read
via "National Vulnerability Database".
esdoc-publish-html-plugin is a plugin for the document maintenance software ESDoc. TheHTML sanitizer in esdoc-publish-html-plugin 1.1.2 and prior can be bypassed which may lead to cross-site scripting (XSS) issues. There are no known patches for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32855 ‼
📖 Read
via "National Vulnerability Database".
Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 contains a patch for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24184 ‼
📖 Read
via "National Vulnerability Database".
TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2015-10083 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been found in harrystech Dynosaur-Rails and classified as critical. Affected by this vulnerability is the function basic_auth of the file app/controllers/application_controller.rb. The manipulation leads to improper authentication. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The name of the patch is 04b223813f0e336aab50bff140d0f5889c31dbec. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221503.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32856 ‼
📖 Read
via "National Vulnerability Database".
Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted in versions 1.2.9 and 1.2.12, but it is incomplete.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32860 ‼
📖 Read
via "National Vulnerability Database".
iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles. An attacker who is able to influence the field `title` when creating a `iziModal` instance is able to supply arbitrary `html` or `javascript` code that will be rendered in the context of a user, potentially leading to `XSS`. Version 1.6.1 contains a patch for this issue📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32854 ‼
📖 Read
via "National Vulnerability Database".
textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. There are no known patches.📖 Read
via "National Vulnerability Database".