‼ CVE-2022-28354 ‼
📖 Read
via "National Vulnerability Database".
In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2260 ‼
📖 Read
via "National Vulnerability Database".
Improper Authorization of Index Containing Sensitive Information in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29530 ‼
📖 Read
via "National Vulnerability Database".
Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling `withHeader()`.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2019 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system.📖 Read
via "National Vulnerability Database".
🕴 Millions of Artifacts, Misconfigured Enterprise Software Registries Are Ripe for Pwning 🕴
📖 Read
via "Dark Reading".
Researchers find 250 million artifacts and 65,000 container images exposed in registries and repositories scattered across the Internet.📖 Read
via "Dark Reading".
Dark Reading
Millions of Artifacts, Misconfigured Enterprise Software Registries Are Ripe for Pwning
Researchers find 250 million artifacts and 65,000 container images exposed in registries and repositories scattered across the Internet.
🕴 Tangled Up: 'Tomiris' APT Uses Turla Malware, Confusing Researchers 🕴
📖 Read
via "Dark Reading".
Researchers are unraveling the threads connecting two separate, but in some ways overlapping, Russian-language APTs.📖 Read
via "Dark Reading".
Dark Reading
Tangled Up: 'Tomiris' APT Uses Turla Malware, Confusing Researchers
Researchers are unraveling the threads connecting two separate, but in some ways overlapping, Russian-language APTs.
‼ CVE-2023-30414 ‼
📖 Read
via "National Vulnerability Database".
Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component vm_loop at /jerry-core/vm/vm.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30623 ‼
📖 Read
via "National Vulnerability Database".
`embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the `embano1/wip` action uses the `github.event.pull_request.title` parameter in an insecure way. The title parameter is used in a run statement - resulting in a command injection vulnerability due to string interpolation. This vulnerability can be triggered by any user on GitHub. They just need to create a pull request with a commit message containing an exploit. (Note that first-time PR requests will not be run - but the attacker can submit a valid PR before submitting an invalid PR). The commit can be genuine, but the commit message can be malicious. This can be used to execute code on the GitHub runners and can be used to exfiltrate any secrets used in the CI pipeline, including repository tokens. Version 2 has a fix for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30629 ‼
📖 Read
via "National Vulnerability Database".
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `True` or `False`. A patch is available and, as of time of publication, anticipated to be part of Vyper 0.3.8. As a workaround, one may always put `max_outsize>0`.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30406 ‼
📖 Read
via "National Vulnerability Database".
Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30408 ‼
📖 Read
via "National Vulnerability Database".
Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30410 ‼
📖 Read
via "National Vulnerability Database".
Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component ecma_op_function_construct at /operations/ecma-function-object.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28771 ‼
📖 Read
via "National Vulnerability Database".
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.📖 Read
via "National Vulnerability Database".
📢 96% of CISOs without necessary support to maintain cyber security 📢
📖 Read
via "ITPro".
Security professionals are leaving due to stress, and called out lack of understanding from co-workers 📖 Read
via "ITPro".
ITPro
96% of CISOs without necessary support to maintain cyber security
Security professionals are leaving due to stress, and called out lack of understanding from co-workers
‼ CVE-2023-30417 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title of a private message.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26840 ‼
📖 Read
via "National Vulnerability Database".
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25348 ‼
📖 Read
via "National Vulnerability Database".
ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25346 ‼
📖 Read
via "National Vulnerability Database".
A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-42335 ‼
📖 Read
via "National Vulnerability Database".
x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26839 ‼
📖 Read
via "National Vulnerability Database".
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25490 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.4 versions.📖 Read
via "National Vulnerability Database".