‼ CVE-2023-25346 ‼
📖 Read
via "National Vulnerability Database".
A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-42335 ‼
📖 Read
via "National Vulnerability Database".
x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26839 ‼
📖 Read
via "National Vulnerability Database".
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25490 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.4 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25710 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin <=Â 1.4.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26843 ‼
📖 Read
via "National Vulnerability Database".
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-26058 ‼
📖 Read
via "National Vulnerability Database".
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26098 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted file to execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25347 ‼
📖 Read
via "National Vulnerability Database".
A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEditor.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-45837 ‼
📖 Read
via "National Vulnerability Database".
Reflected Cross-Site Scripting (XSS) vulnerability in Denis ???????? plugin <=Â 6.0.1 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27619 ‼
📖 Read
via "National Vulnerability Database".
Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <=Â 2.0.7 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26057 ‼
📖 Read
via "National Vulnerability Database".
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25479 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Subscribe button plugin <=Â 1.3.7 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26841 ‼
📖 Read
via "National Vulnerability Database".
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in.📖 Read
via "National Vulnerability Database".
🕴 Building a Better SBOM 🕴
📖 Read
via "Dark Reading".
Generating an SBOM is easy. It's generating one that's comprehensive and accurate that's hard.📖 Read
via "Dark Reading".
Dark Reading
Building a Better SBOM
Generating an SBOM is easy. It's generating one that's comprehensive and accurate that's hard.
📢 How to reduce the risk of phishing and ransomware 📢
📖 Read
via "ITPro".
Top security concerns and tips for mitigation 📖 Read
via "ITPro".
ITPro
How to reduce the risk of phishing and ransomware
Top security concerns and tips for mitigation
‼ CVE-2023-29779 ‼
📖 Read
via "National Vulnerability Database".
Sengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes. After receiving the malicious command, the device will keep reporting its status and finally drain its battery after receiving the 'Set_short_poll_interval' command.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27105 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X Portable Music Player with Shanling MTouch OS v3.3 allows attackers to arbitrarily read, delete, or modify any critical system files via directory traversal.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2281 ‼
📖 Read
via "National Vulnerability Database".
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.📖 Read
via "National Vulnerability Database".
⚠ Double zero-day in Chrome and Edge – check your versions now! ⚠
📖 Read
via "Naked Security".
Wouldn't it be handy if there were a single version number to check for in every Chromium-based browser, on every supported platform?📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🕴 The Decline in Ransomware: Does It Actually Increase Risks for Organizations? 🕴
📖 Read
via "Dark Reading".
Organizations need to remain vigilant and not take the decline as reason to cut back their cybersecurity strategies.📖 Read
via "Dark Reading".
Dark Reading
The Decline in Ransomware: Does It Actually Increase Risks for Organizations?
Organizations need to remain vigilant and not take the decline as reason to cut back their cybersecurity strategies.