‼ CVE-2023-23711 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in A2 Hosting A2 Optimized WP plugin <= 3.0.4 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27062 ‼
📖 Read
via "National Vulnerability Database".
Tenda V15V1.0 was discovered to contain a buffer overflow vulnerability via the gotoUrl parameter in the formPortalAuth function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31474 ‼
📖 Read
via "National Vulnerability Database".
Directory Traversal vulnerability in iThemes BackupBuddy plugin 8.5.8.0 - 8.7.4.1 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27061 ‼
📖 Read
via "National Vulnerability Database".
Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the wifiFilterListRemark parameter in the modifyWifiFilterRules function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26073 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123, and Exynos W920. A heap-based buffer overflow in the 5G MM message codec can occur due to insufficient parameter validation when decoding the extended emergency number list.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0978 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operating system commands using specially crafted strings. This vulnerability is due to insufficient validation of arguments that are passed to specific CLI command. The vulnerability allows the attack📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27064 ‼
📖 Read
via "National Vulnerability Database".
Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the index parameter in the formDelDnsForward function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27065 ‼
📖 Read
via "National Vulnerability Database".
Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the picName parameter in the formDelWewifiPi function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24762 ‼
📖 Read
via "National Vulnerability Database".
OS Command injection vulnerability in D-Link DIR-867 DIR_867_FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPAddress parameter for the SetVirtualServerSettings to HNAP1.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22700 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 9.3.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25991 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic plugin <= 5.1.9.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38074 ‼
📖 Read
via "National Vulnerability Database".
SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27063 ‼
📖 Read
via "National Vulnerability Database".
Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the DNSDomainName parameter in the formModifyDnsForward function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26076 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. An intra-object overflow in the 5G SM message codec can occur due to insufficient parameter validation when decoding reserved options.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27093 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting vulnerability found in My-Blog allows attackers to cause a denial of service via the Post function.📖 Read
via "National Vulnerability Database".
⚠ SHEIN shopping app goes rogue, grabs price and URL data from your clipboard ⚠
📖 Read
via "Naked Security".
It's not exactly data theft, but it's worryingly close to "unintentional treachery" - apparently because it's great for marketing purposes📖 Read
via "Naked Security".
Naked Security
SHEIN shopping app goes rogue, grabs price and URL data from your clipboard
It’s not exactly data theft, but it’s worryingly close to “unintentional treachery” – apparently because it’s great for marketing purposes
🔥1
⚠ Linux gets double-quick double-update to fix kernel Oops! ⚠
📖 Read
via "Naked Security".
Linux doesn't BSoD. It has oopses and panics instead. (We show you how to make a kernel module to explore further.)📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2023-0538 ‼
📖 Read
via "National Vulnerability Database".
The Campaign URL Builder WordPress plugin before 1.8.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0037 ‼
📖 Read
via "National Vulnerability Database".
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0749 ‼
📖 Read
via "National Vulnerability Database".
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25170 ‼
📖 Read
via "National Vulnerability Database".
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.📖 Read
via "National Vulnerability Database".