‼ CVE-2023-28848 ‼
📖 Read
via "National Vulnerability Database".
user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allowed an attacker to bypass the state protection as they could just copy the expected state token from the first request to their second request. Users should upgrade user_oidc to 1.3.0 to receive a patch for the issue. No known workarounds are available.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29000 ‼
📖 Read
via "National Vulnerability Database".
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could get the desktop client to encrypt files with a key known to the attacker. This issue is fixed in Nextcloud Desktop 3.7.0. No known workarounds are available.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2020-20914 ‼
📖 Read
via "National Vulnerability Database".
SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-27768 ‼
📖 Read
via "National Vulnerability Database".
An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement-pro_setup_full5239.exe file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27766 ‼
📖 Read
via "National Vulnerability Database".
An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_full9589.exe file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27762 ‼
📖 Read
via "National Vulnerability Database".
An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democreator_setup_full7743.exe file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27769 ‼
📖 Read
via "National Vulnerability Database".
An issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreader_setup_full13143.exe file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27771 ‼
📖 Read
via "National Vulnerability Database".
An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the wondershareCC_setup_full10819.exe file.📖 Read
via "National Vulnerability Database".
⚠ Researchers claim they can bypass Wi-Fi encryption (briefly, at least) ⚠
📖 Read
via "Naked Security".
They can't read much of your data, but even a few stray network packets could tell them something they're not supposed to know.📖 Read
via "Naked Security".
Naked Security
Researchers claim they can bypass Wi-Fi encryption (briefly, at least)
They can’t read much of your data, but even a few stray network packets could tell them something they’re not supposed to know.
🕴 What RASP Should Have Been 🕴
📖 Read
via "Dark Reading".
When runtime application self-protection is held to a higher standard, it can secure thousands of applications and prevent burnout in security teams.📖 Read
via "Dark Reading".
Dark Reading
What RASP Should Have Been
When runtime application self-protection is held to a higher standard, it can secure thousands of applications and prevent burnout in security teams.
⚠ Einstein tilings – the amazing “Hat” shape that never repeats! ⚠
📖 Read
via "Naked Security".
Imagine tiling a whole football field using a single shape... yet not being able to produce a repeating pattern, even if you wanted to.📖 Read
via "Naked Security".
Naked Security
Einstein tilings – the amazing “Hat” shape that never repeats!
Imagine tiling a whole football field using a single shape… yet not being able to produce a repeating pattern, even if you wanted to.
🕴 15M+ Services & Apps Remain Sitting Ducks for Known Exploits 🕴
📖 Read
via "Dark Reading".
Scans of the Internet find that millions of computers, virtual machines, and containers are vulnerable to one or more of the hundreds of cyberattacks currently used in the wild, despite being patchable.📖 Read
via "Dark Reading".
Dark Reading
15M+ Services & Apps Remain Sitting Ducks for Known Exploits
Scans of the Internet find that millions of computers, virtual machines, and containers are vulnerable to one or more of the hundreds of cyberattacks currently used in the wild, despite being patchable.
‼ CVE-2023-1752 ‼
📖 Read
via "National Vulnerability Database".
The listed versions of Nexx Smart Home devices could allow any user to register an already registered alarm or associated device with only the device’s MAC address.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48227 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Acuant AsureID Sentinel before 5.2.149. It allows elevation of privileges because it opens Notepad after the installation of AssureID, Identify x64, and Identify x86, aka CORE-7361.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1749 ‼
📖 Read
via "National Vulnerability Database".
The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could send API requests that the affected devices would execute.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1748 ‼
📖 Read
via "National Vulnerability Database".
The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the ability to remotely control garage doors or smart plugs for any customer.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1750 ‼
📖 Read
via "National Vulnerability Database".
The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could retrieve device history, set device settings, and retrieve device information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27487 ‼
📖 Read
via "National Vulnerability Database".
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-path` should be an internal header, but Envoy does not remove this header from the request at the beginning of request processing when it is sent from an untrusted client. The faked header would then be used for trace logs and grpc logs, as well as used in the URL used for `jwt_authn` checks if the `jwt_authn` filter is used, and any other upstream use of the x-envoy-original-path header. Attackers may forge a trusted `x-envoy-original-path` header. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 have patches for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28613 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, and Exynos Modem 5300. An integer overflow in IPv4 fragment handling can occur due to insufficient parameter validation when reassembling these fragments.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1751 ‼
📖 Read
via "National Vulnerability Database".
The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the device attempting to associate. This could allow any authorized user to receive alarm information and signals meant for other devices which leak a deviceId.📖 Read
via "National Vulnerability Database".
🕴 Mysterious 'Rorschach' Ransomware Doubles Known Encryption Speeds 🕴
📖 Read
via "Dark Reading".
The malware is one of the most sophisticated ransomwares ever seen in the wild, and marks a leap ahead for cybercrime.📖 Read
via "Dark Reading".
Dark Reading
Mysterious 'Rorschach' Ransomware Doubles Known Encryption Speeds
The malware is one of the most sophisticated ransomwares ever seen in the wild, and marks a leap ahead for cybercrime.