‼ CVE-2023-28144 ‼
📖 Read
via "National Vulnerability Database".
KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27589 ‼
📖 Read
via "National Vulnerability Database".
Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z. There are ways to work around this via adding higher privileges to the disabled root user via `mc admin policy set`.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28339 ‼
📖 Read
via "National Vulnerability Database".
OpenDoas through 6.8.2, when TIOCSTI is available, allows privilege escalation because of sharing a terminal with the original session. NOTE: TIOCSTI is unavailable in OpenBSD 6.0 and later, and can be made unavailable in the Linux kernel 6.2 and later.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27588 ‼
📖 Read
via "National Vulnerability Database".
Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.📖 Read
via "National Vulnerability Database".
🕴 LockBit Threatens to Leak Stolen SpaceX Schematics 🕴
📖 Read
via "Dark Reading".
The ransomware group sent a message directly to Elon Musk: Pay or the confidential SpaceX information goes up for grabs on the Dark Web.📖 Read
via "Dark Reading".
Dark Reading
LockBit Threatens to Leak Stolen SpaceX Schematics
The ransomware group sent a message directly to Elon Musk: Pay or the confidential SpaceX information goes up for grabs on the Dark Web.
📢 17 Windows 10 problems and how to fix them 📢
📖 Read
via "ITPro".
Tips and tricks to help you solve the most common Windows 10 problems, whether that's freeing up storage or handling safe mode📖 Read
via "ITPro".
ITPro
17 common Windows 10 problems and how to fix them
Tips and tricks to help you solve the most common Windows 10 problems, whether that's freeing up storage or handling safe mode
🕴 Samsung Next Invests in Mitiga, Brings Total Funding to $45M 🕴
📖 Read
via "Dark Reading".
Financing will help support increasing customer demand while continuing to transform incident response for cloud and SaaS environments📖 Read
via "Dark Reading".
Dark Reading
Samsung Next Invests in Mitiga, Brings Total Funding to $45M
Financing will help support increasing customer demand while continuing to transform incident response for cloud and SaaS environments
🕴 Microsoft Zero-Day Bugs Allow Security Feature Bypass 🕴
📖 Read
via "Dark Reading".
Security vendors urge organizations to fix the actively exploited bugs, in Microsoft Outlook and the Mark of the Web feature, immediately.📖 Read
via "Dark Reading".
Dark Reading
Microsoft Zero-Day Bugs Allow Security Feature Bypass
Security vendors urge organizations to fix the actively exploited bugs, in Microsoft Outlook and the Mark of the Web feature, immediately.
🕴 Camozzi Group and Radiflow Announce Collaboration on Industrial Systems Cybersecurity 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
Camozzi Group and Radiflow Announce Collaboration on Industrial Systems Cybersecurity
Brescia, Istanbul, Tel Aviv, March 14th, 2023 — Camozzi Group, a leading provider of Industrial Automation solutions, and Radiflow, part of Sabanci Holding and a global player in Industrial Cybersecurity and Operational Technology (OT), have announced a collaboration…
‼ CVE-2023-28343 ‼
📖 Read
via "National Vulnerability Database".
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26262 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27590 ‼
📖 Read
via "National Vulnerability Database".
Rizin is a UNIX-like reverse engineering framework and command-line toolset. In version 0.5.1 and prior, converting a GDB registers profile file into a Rizin register profile can result in a stack-based buffer overflow when the `name`, `type`, or `groups` fields have longer values than expected. Users opening untrusted GDB registers files (e.g. with the `drpg` or `arpg` commands) are affected by this flaw. Commit d6196703d89c84467b600ba2692534579dc25ed4 contains a patch for this issue. As a workaround, review the GDB register profiles before loading them with `drpg`/`arpg` commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26511 ‼
📖 Read
via "National Vulnerability Database".
A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain access to the admin panel Propiusadmin.php, which allows taking control of the affected system.📖 Read
via "National Vulnerability Database".
🕴 Optiv More Than Doubles Federal Presence With ClearShark Acquisition 🕴
📖 Read
via "Dark Reading".
Convergence of two leading cybersecurity companies creates federal sector powerhouse.📖 Read
via "Dark Reading".
Dark Reading
Optiv More Than Doubles Federal Presence With ClearShark Acquisition
Convergence of two leading cybersecurity companies creates federal sector powerhouse.
⚠ Firefox 111 patches 11 holes, but not 1 zero-day among them… ⚠
📖 Read
via "Naked Security".
In the game of cricket, 111 is an inauspicious number, but for Firefox, there doesn't seem to be much to worry about this month.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
⚠ Microsoft fixes two 0-days on Patch Tuesday – update now! ⚠
📖 Read
via "Naked Security".
An email you haven't even looked at yet could be used to trick your mail server into helping crooks to logon as you.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2023-1327 ‼
📖 Read
via "National Vulnerability Database".
Netgear RAX30 (AX2400), prior to version 1.0.6.74, was affected by an authentication bypass vulnerability, allowing an unauthenticated attacker to gain administrative access to the device's web management interface by resetting the admin password.📖 Read
via "National Vulnerability Database".
🕴 How Patch Tuesday Keeps the Beat After 20 Years 🕴
📖 Read
via "Dark Reading".
Patch Tuesday turned security updates from chaotic events into a routine. Here's how we got here, and where things might be heading.📖 Read
via "Dark Reading".
Dark Reading
How Patch Tuesday Keeps the Beat After 20 Years
Patch Tuesday turned security updates from chaotic events into a routine. Here's how we got here and where things might be heading.
♟️ Two U.S. Men Charged in 2022 Hacking of DEA Portal ♟️
📖 Read
via "Krebs on Security".
Two U.S. men have been charged with hacking into a U.S. Drug Enforcement Agency (DEA) online portal that taps into 16 different federal law enforcement databases. Both are alleged to be part of a larger criminal organization that specializes in using fake emergency data requests from compromised police and government email accounts to publicly threaten and extort their victims.📖 Read
via "Krebs on Security".
Krebs on Security
Two U.S. Men Charged in 2022 Hacking of DEA Portal
Two U.S. men have been charged with hacking into a U.S. Drug Enforcement Agency (DEA) online portal that taps into 16 different federal law enforcement databases. Both are alleged to be part of a larger criminal organization that specializes in…
‼ CVE-2023-27235 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1407 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223111.📖 Read
via "National Vulnerability Database".
👍1