โผ CVE-2023-26245 โผ
๐ Read
via "National Vulnerability Database".
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the version check in order to install any firmware version (e.g., newer, older, or customized). This indirectly allows an attacker to install custom firmware in the IVI system.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-2297 โผ
๐ Read
via "National Vulnerability Database".
The Profile Builder รขโฌโ User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-22901 โผ
๐ Read
via "National Vulnerability Database".
ChangingTec MOTP system has a path traversal vulnerability. A remote attacker with administratorรขโฌโขs privilege can exploit this vulnerability to access arbitrary system files.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-2323 โผ
๐ Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-28770 โผ
๐ Read
via "National Vulnerability Database".
The sensitive information exposure vulnerability in the CGI รขโฌลExport_Logรขโฌ๏ฟฝ and the binary รขโฌลzcmdรขโฌ๏ฟฝ in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from the encrypted file.๐ Read
via "National Vulnerability Database".
๐ข Microsoft links PaperCut server attacks to Cl0p, LockBit ransomware ๐ข
๐ Read
via "ITPro".
Microsoft Threat Intelligence noted attacks were facilitated by GoAnywhere vulnerabilities and the Raspberry Robin worm ๐ Read
via "ITPro".
ITPro
Microsoft links PaperCut server attacks to Cl0p, LockBit ransomware
Microsoft Threat Intelligence noted attacks were facilitated by GoAnywhere vulnerabilities and the Raspberry Robin worm
โผ CVE-2023-1778 โผ
๐ Read
via "National Vulnerability Database".
This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web-based management interface and/or exposed SSH port thereby enabling remote attackers to execute arbitrary commands with administrative/superuser privileges on the targeted systems.The vulnerability has been addressed by forcing the user to change their default password to a new non-default password.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-2327 โผ
๐ Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-2328 โผ
๐ Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.๐ Read
via "National Vulnerability Database".
๐ด Tenable Makes Generative AI Security Tools Available to the Research Community ๐ด
๐ Read
via "Dark Reading".
๐ Read
via "Dark Reading".
Dark Reading
Tenable Makes Generative AI Security Tools Available to the Research Community
COLUMBIA, Md. and RSA Conference 2023 (April 27, 2023) โ Tenableยฎ, the Exposure Management company, today published a new report outlining the use of generative AI to build new security research tools. The report, titled โHow Generative AI is Changing Securityโฆ
๐ด Combating Kubernetes โ the Newest IAM Challenge ๐ด
๐ Read
via "Dark Reading".
IT leaders need to ensure Kubernetes clusters don't become a gateway for cybercriminals.๐ Read
via "Dark Reading".
Dark Reading
Combating Kubernetes โ the Newest IAM Challenge
IT leaders need to ensure Kubernetes clusters don't become a gateway for cybercriminals.
โค1
โผ CVE-2023-2336 โผ
๐ Read
via "National Vulnerability Database".
Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-29255 โผ
๐ Read
via "National Vulnerability Database".
IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as it may trap when compiling a variation of an anonymous block. IBM X-Force ID: 251991.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-2339 โผ
๐ Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.๐ Read
via "National Vulnerability Database".
โ Google leaking 2FA secrets โ researchers advise against new โaccount syncโ feature for now โ
๐ Read
via "Naked Security".
You waited 13 years for this feature in Google Authenticator. Now researchers are advising you to wait a while longer, just in case...๐ Read
via "Naked Security".
Sophos News
Naked Security โ Sophos News
โผ CVE-2023-2344 โผ
๐ Read
via "National Vulnerability Database".
A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=save_service of the component HTTP POST Request Handler. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227587.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-30847 โผ
๐ Read
via "National Vulnerability Database".
H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to build an upstream URL by reading from uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers. Pull request number 3229 fixes the issue. The pull request has been merged to the `master` branch in commit f010336. Users should upgrade to commit f010336 or later.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-2341 โผ
๐ Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-24966 โผ
๐ Read
via "National Vulnerability Database".
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246904.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-2347 โผ
๐ Read
via "National Vulnerability Database".
A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/services/manage_service.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227590 is the identifier assigned to this vulnerability.๐ Read
via "National Vulnerability Database".
โผ CVE-2023-30338 โผ
๐ Read
via "National Vulnerability Database".
Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters.๐ Read
via "National Vulnerability Database".
๐1