‼ CVE-2023-1971 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the file application\admin\controller\Upload.php. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225408. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1969 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. This vulnerability affects unknown code of the file /admin/inventory/manage_stock.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-225406 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26919 ‼
📖 Read
via "National Vulnerability Database".
delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process.📖 Read
via "National Vulnerability Database".
🕴 High-Stakes Ransomware Response: Know What Cards You Hold 🕴
📖 Read
via "Dark Reading".
When ransomware strikes, how much should you gamble on your resources and opponents' intentions? Here's how to deal yourself a rational, informed way to weigh your options after an attack.📖 Read
via "Dark Reading".
Dark Reading
High-Stakes Ransomware Response: Know What Cards You Hold
When ransomware strikes, how much should you gamble on your resources and opponents' intentions? Here's how to deal yourself a rational, informed way to weigh your options after an attack.
‼ CVE-2023-28206 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 15.7.5 and iPadOS 15.7.5, macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Big Sur 11.7.6, macOS Ventura 13.3.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.📖 Read
via "National Vulnerability Database".
‼ CVE-2018-25084 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2. Affected by this issue is some unknown functionality of the file src/main/java/com/unboundid/webapp/ssam/SSAMController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.1.3 is able to address this issue. The name of the patch is f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251. It is recommended to upgrade the affected component. VDB-225362 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28205 ‼
📖 Read
via "National Vulnerability Database".
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.7.5 and iPadOS 15.7.5, Safari 16.4.1, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46709 ‼
📖 Read
via "National Vulnerability Database".
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 16. An app may be able to execute arbitrary code with kernel privileges📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46716 ‼
📖 Read
via "National Vulnerability Database".
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. Private Relay functionality did not match system settings📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46717 ‼
📖 Read
via "National Vulnerability Database".
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2. A user with physical access to a locked Apple Watch may be able to view user photos via accessibility features📖 Read
via "National Vulnerability Database".
‼ CVE-2015-10100 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10. This issue affects some unknown processing of the file classes/dynwid_class.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.11 is able to address this issue. The name of the patch is d0a19c6efcdc86d7093b369bc9e29a0629e57795. It is recommended to upgrade the affected component. The identifier VDB-225353 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46703 ‼
📖 Read
via "National Vulnerability Database".
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2. An app may be able to read sensitive location information📖 Read
via "National Vulnerability Database".
‼ CVE-2022-42858 ‼
📖 Read
via "National Vulnerability Database".
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32871 ‼
📖 Read
via "National Vulnerability Database".
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16. A person with physical access to a device may be able to use Siri to access private calendar information📖 Read
via "National Vulnerability Database".
🕴 Pair of Apple Zero-Days Under Active Exploit; Patch & Update Accordingly 🕴
📖 Read
via "Dark Reading".
Unpatched Macs, iPhones, and iPads open to browser takeover and system kernel-level malicious code execution, Apple warns.📖 Read
via "Dark Reading".
Dark Reading
Pair of Apple Zero-Days Under Active Exploit; Patch & Update Accordingly
Unpatched Macs, iPhones, and iPads open to browser takeover and system kernel-level malicious code execution, Apple warns.
âš Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads âš
📖 Read
via "Naked Security".
That double-whammy Apple browser-to-kernel spyware bug combo we wrote up last week? Turns out it applies to all supported Macs and iDevices - patch now!📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🕴 Apps for Sale: Cybercriminals Sell Android Hacks for Up to $20K a Pop 🕴
📖 Read
via "Dark Reading".
The marketplace for malicious Google Play applications and app-takeover tools is thriving, thanks to novel hacking techniques and lax enterprise security.📖 Read
via "Dark Reading".
Dark Reading
Apps for Sale: Cybercriminals Sell Android Hacks for Up to $20K a Pop
The marketplace for malicious Google Play applications and app-takeover tools is thriving, thanks to novel hacking techniques and lax enterprise security.
‼ CVE-2023-26066 ‼
📖 Read
via "National Vulnerability Database".
Certain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26070 ‼
📖 Read
via "National Vulnerability Database".
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 4 of 4).📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26067 ‼
📖 Read
via "National Vulnerability Database".
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27178 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary file upload vulnerability in the upload function of GDidees CMS 3.9.1 allows attackers to execute arbitrary code via a crafted file.📖 Read
via "National Vulnerability Database".