‼ CVE-2022-41739 ‼
📖 Read
via "National Vulnerability Database".
IBM Spectrum Scale (IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0) could allow programs running inside the container to overcome isolation mechanism and gain additional capabilities or access sensitive information on the host. IBM X-Force ID: 237815.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27843 ‼
📖 Read
via "National Vulnerability Database".
SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesProduct::deleteProduct component.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26735 ‼
📖 Read
via "National Vulnerability Database".
blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26560 ‼
📖 Read
via "National Vulnerability Database".
Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and potentially discover credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36769 ‼
📖 Read
via "National Vulnerability Database".
IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 232034.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30106 ‼
📖 Read
via "National Vulnerability Database".
Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30111 ‼
📖 Read
via "National Vulnerability Database".
Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).📖 Read
via "National Vulnerability Database".
🕴 Effects of the Hive Ransomware Group Takedown 🕴
📖 Read
via "Dark Reading".
Despite some success in limiting damage from Hive, there's no time to relax security vigilance. 📖 Read
via "Dark Reading".
Dark Reading
Effects of the Hive Ransomware Group Takedown
Despite some success in limiting damage from Hive, there's no time to relax security vigilance.
‼ CVE-2023-24796 ‼
📖 Read
via "National Vulnerability Database".
Password vulnerability found in Vinga WR-AC1200 81.102.1.4370 and before allows a remote attacker to execute arbitrary code via the password parameter at the /goform/sysTools and /adm/systools.asp endpoints.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26286 ‼
📖 Read
via "National Vulnerability Database".
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX runtime services library to execute arbitrary commands. IBM X-Force ID: 248421.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29257 ‼
📖 Read
via "National Vulnerability Database".
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to remote code execution as a database administrator of one database may execute code or read/write files from another database within the same instance. IBM X-Force ID: 252011.📖 Read
via "National Vulnerability Database".
🕴 Metaverse Version of the Dark Web Could be Nearly Impenetrable 🕴
📖 Read
via "Dark Reading".
Law enforcement will likely find it much harder to take down criminal activities on the "deepverse."📖 Read
via "Dark Reading".
Dark Reading
Metaverse Version of the Dark Web Could Be Nearly Impenetrable
Law enforcement will likely find it much harder to take down criminal activities on the "deepverse."
‼ CVE-2022-25273 ‼
📖 Read
via "National Vulnerability Database".
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25278 ‼
📖 Read
via "National Vulnerability Database".
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25277 ‼
📖 Read
via "National Vulnerability Database".
Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-39989 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor prompt the administrators to change the credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25275 ‼
📖 Read
via "National Vulnerability Database".
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22728 ‼
📖 Read
via "National Vulnerability Database".
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30267 ‼
📖 Read
via "National Vulnerability Database".
CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22729 ‼
📖 Read
via "National Vulnerability Database".
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can display a link to a third party website on a login screen by convincing a legitimate content author to follow a specially crafted link. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25276 ‼
📖 Read
via "National Vulnerability Database".
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.📖 Read
via "National Vulnerability Database".