‼ CVE-2023-28999 ‼
📖 Read
via "National Vulnerability Database".
Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.? This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-23821 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marcin Pietrzak Interactive Polish Map plugin <= 1.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26866 ‼
📖 Read
via "National Vulnerability Database".
GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote command injection. Commands are executed using pre-login execution and executed with root privileges allowing complete takeover.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23977 ‼
📖 Read
via "National Vulnerability Database".
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments plugin <= 1.6.1 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25356 ‼
📖 Read
via "National Vulnerability Database".
CoreDial sipXcom up to and including 21.04 is vulnerable to Improper Neutralization of Argument Delimiters in a Command. XMPP users are able to inject arbitrary arguments into a system command, which can be used to read files from, and write files to, the sipXcom server. This can also be leveraged to gain remote command execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41633 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23870 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25303 ‼
📖 Read
via "National Vulnerability Database".
ATLauncher <= 3.4.26.0 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation directory.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28998 ‼
📖 Read
via "National Vulnerability Database".
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.? Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28997 ‼
📖 Read
via "National Vulnerability Database".
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can recover and modify the contents of end-to-end encrypted files. Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25355 ‼
📖 Read
via "National Vulnerability Database".
CoreDial sipXcom up to and including 21.04 is vulnerable to Insecure Permissions. A user who has the ability to run commands as the `daemon` user on a sipXcom server can overwrite a service file, and escalate their privileges to `root`.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28848 ‼
📖 Read
via "National Vulnerability Database".
user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allowed an attacker to bypass the state protection as they could just copy the expected state token from the first request to their second request. Users should upgrade user_oidc to 1.3.0 to receive a patch for the issue. No known workarounds are available.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29000 ‼
📖 Read
via "National Vulnerability Database".
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could get the desktop client to encrypt files with a key known to the attacker. This issue is fixed in Nextcloud Desktop 3.7.0. No known workarounds are available.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2020-20914 ‼
📖 Read
via "National Vulnerability Database".
SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-27768 ‼
📖 Read
via "National Vulnerability Database".
An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement-pro_setup_full5239.exe file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27766 ‼
📖 Read
via "National Vulnerability Database".
An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_full9589.exe file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27762 ‼
📖 Read
via "National Vulnerability Database".
An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democreator_setup_full7743.exe file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27769 ‼
📖 Read
via "National Vulnerability Database".
An issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreader_setup_full13143.exe file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27771 ‼
📖 Read
via "National Vulnerability Database".
An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the wondershareCC_setup_full10819.exe file.📖 Read
via "National Vulnerability Database".
⚠ Researchers claim they can bypass Wi-Fi encryption (briefly, at least) ⚠
📖 Read
via "Naked Security".
They can't read much of your data, but even a few stray network packets could tell them something they're not supposed to know.📖 Read
via "Naked Security".
Naked Security
Researchers claim they can bypass Wi-Fi encryption (briefly, at least)
They can’t read much of your data, but even a few stray network packets could tell them something they’re not supposed to know.
🕴 What RASP Should Have Been 🕴
📖 Read
via "Dark Reading".
When runtime application self-protection is held to a higher standard, it can secure thousands of applications and prevent burnout in security teams.📖 Read
via "Dark Reading".
Dark Reading
What RASP Should Have Been
When runtime application self-protection is held to a higher standard, it can secure thousands of applications and prevent burnout in security teams.