‼ CVE-2023-25484 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Oliver Schlöbe Simple Yearly Archive plugin <= 2.1.8 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47608 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <=Â 8.0.3.1 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25313 ‼
📖 Read
via "National Vulnerability Database".
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28847 ‼
📖 Read
via "National Vulnerability Database".
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server Enterprise 23.0.0 prior to 23.0.12.6, 24.0.0 prior to 24.0.11, and 25.0.0 prior to 25.0.5; an attacker is not restricted in verifying passwords of share links so they can just start brute forcing the password. Nextcloud Server 24.0.11 and 25.0.5 and Nextcloud Enterprise Server 23.0.12.6, 24.0.11, and 25.0.5 contain a fix for this issue. No known workarounds are available.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30402 ‼
📖 Read
via "National Vulnerability Database".
YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29552 ‼
📖 Read
via "National Vulnerability Database".
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25314 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user.📖 Read
via "National Vulnerability Database".
🕴 Attackers Abuse PaperCut RCE Flaws to Take Over Enterprise Print Servers 🕴
📖 Read
via "Dark Reading".
Customers should apply updates to the print management software used by more than 100 million organizations worldwide, with typical US customers found in the SLED sector.📖 Read
via "Dark Reading".
Dark Reading
Attackers Abuse PaperCut RCE Flaws to Take Over Enterprise Print Servers
Customers should apply updates to the print management software used by more than 100 million organizations worldwide, with typical US customers found in the SLED sector.
🕴 'Good' AI Is the Only Path to True Zero-Trust Architecture 🕴
📖 Read
via "Dark Reading".
Ultimately AI will protect the enterprise, but it's up to the cybersecurity community to protect 'good' AI in order to get there, RSA's Rohit Ghai says.📖 Read
via "Dark Reading".
Dark Reading
'Good' AI Is the Only Path to True Zero-Trust Architecture
Ultimately, AI will protect the enterprise, but it's up to the cybersecurity community to protect "good" AI in order to get there, RSA's Rohit Ghai says.
‼ CVE-2023-30177 ‼
📖 Read
via "National Vulnerability Database".
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40723 ‼
📖 Read
via "National Vulnerability Database".
The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28089 ‼
📖 Read
via "National Vulnerability Database".
An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28086 ‼
📖 Read
via "National Vulnerability Database".
An HPE OneView appliance dump may expose proxy credential settings📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28087 ‼
📖 Read
via "National Vulnerability Database".
An HPE OneView appliance dump may expose OneView user accounts📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45111 ‼
📖 Read
via "National Vulnerability Database".
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demonstration data, including user accounts with known credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40725 ‼
📖 Read
via "National Vulnerability Database".
PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before the time-based lockout is activated.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30545 ‼
📖 Read
via "National Vulnerability Database".
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28090 ‼
📖 Read
via "National Vulnerability Database".
An HPE OneView appliance dump may expose SNMPv3 read credentials📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30839 ‼
📖 Read
via "National Vulnerability Database".
PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23721 ‼
📖 Read
via "National Vulnerability Database".
PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same username are provisioned onto the same machine at different times.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-45291 ‼
📖 Read
via "National Vulnerability Database".
PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php. Attacks can use the PWS_printfile.php, PWS_frame_text.php, PWS_listfile.php, PWS_winter.php, and PWS_easyweathersetup.php endpoints. A contributing factor is a hardcoded login password of support, which is not documented. (This is not the same as the documented setup password, which is 12345.) The issue was fixed in late 2022.📖 Read
via "National Vulnerability Database".