‼ CVE-2023-30869 ‼
📖 Read
via "National Vulnerability Database".
Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.📖 Read
via "National Vulnerability Database".
📢 Malware being pushed to businesses by search engines remains a pervasive threat 📢
📖 Read
via "ITPro".
High-profile malvertising campaigns in recent months have surged 📖 Read
via "ITPro".
ITPro
Malware being pushed to businesses by search engines remains a pervasive threat
High-profile malvertising campaigns in recent months have surged
🕴 4 Principles for Creating a New Blueprint for Secure Software Development 🕴
📖 Read
via "Dark Reading".
Improving the security of the software development process is key to thwarting bad actors.📖 Read
via "Dark Reading".
Dark Reading
4 Principles for Creating a New Blueprint for Secure Software Development
Improving the security of the software development process is key to thwarting bad actors.
‼ CVE-2023-2474 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-227866 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2475 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic. This issue affects some unknown processing of the component System Message Handler. The manipulation of the argument ?? leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 7a9e1a00e3329fdc0ae05f7a8257cce77037134d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-227867.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29772 ‼
📖 Read
via "National Vulnerability Database".
A Cross-site scripting (XSS) vulnerability in the System Log/General Log page of the administrator web UI in ASUS RT-AC51U wireless router firmware version up to and including 3.0.0.4.380.8591 allows remote attackers to inject arbitrary web script or HTML via a malicious network request.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23723 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Email Capture plugin <=Â 3.9.3 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2473 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects the function updatePwd of the file UserController.java of the component Password Hash Calculation. The manipulation leads to inefficient algorithmic complexity. The attack can be initiated remotely. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227860.📖 Read
via "National Vulnerability Database".
🕴 Google Ads Abused to Lure Corporate Workers to LOBSHOT Backdoor 🕴
📖 Read
via "Dark Reading".
The cyberattack campaign, similar to one to spread the Rhadamanthys Stealer, is part of a larger trend by attackers to use malvertising as initial access for ransomware and other threat activity.📖 Read
via "Dark Reading".
Dark Reading
Google Ads Abused to Lure Corporate Workers to LOBSHOT Backdoor
The cyberattack campaign, similar to one to spread the Rhadamanthys Stealer, is part of a larger trend by attackers to use malvertising as initial access for ransomware and other threat activity.
🛠 MIMEDefang Email Scanner 3.4.1 🛠
📖 Read
via "Packet Storm Security".
MIMEDefang is a flexible MIME email scanner designed to protect Windows clients from viruses. Includes the ability to do many other kinds of mail processing, such as replacing parts of messages with URLs. It can alter or delete various parts of a MIME message according to a very flexible configuration file. It can also bounce messages with unacceptable attachments. MIMEDefang works with the Sendmail 8.11 and newer "Milter" API, which makes it more flexible and efficient than procmail-based approaches.📖 Read
via "Packet Storm Security".
Packetstormsecurity
MIMEDefang Email Scanner 3.4.1 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🛠 Clam AntiVirus Toolkit 1.1.0 🛠
📖 Read
via "Packet Storm Security".
Clam AntiVirus is an anti-virus toolkit for Unix. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command-line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use in your own software. This is the LTS source code release.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Clam AntiVirus Toolkit 1.1.0 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
‼ CVE-2023-2476 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Dromara J2eeFAST up to 2.6.0. It has been classified as problematic. Affected is an unknown function of the component Announcement Handler. The manipulation of the argument ????/???? leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 7a9e1a00e3329fdc0ae05f7a8257cce77037134d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-227868.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2477 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Funadmin up to 3.2.3. It has been declared as problematic. Affected by this vulnerability is the function tagLoad of the file Cx.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227869 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2479 ‼
📖 Read
via "National Vulnerability Database".
OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29856 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** D-Link DIR-868L Hardware version A1, firmware version 1.12 is vulnerable to Buffer Overflow. The vulnerability is in scandir.sgi binary.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2445 ‼
📖 Read
via "National Vulnerability Database".
Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrieve usage information on folders in user vaults via a specific folder name.📖 Read
via "National Vulnerability Database".
📢 Five things to consider before choosing an MFA solution 📢
📖 Read
via "ITPro".
Because we all should move on from using “password” as a password 📖 Read
via "ITPro".
ITPro
Five things to consider before choosing an MFA solution
Because we all should move on from using “password” as a password
🕴 North Korean APT Gets Around Macro-Blocking With LNK Switch-Up 🕴
📖 Read
via "Dark Reading".
APT37 is among a growing list of threat actors that have switched to Windows shortcut files after Microsoft blocked macros last year.📖 Read
via "Dark Reading".
Dark Reading
North Korean APT Gets Around Macro-Blocking With LNK Switch-Up
APT37 is among a growing list of threat actors that have switched to Windows shortcut files after Microsoft blocked macros last year.
‼ CVE-2023-29868 ‼
📖 Read
via "National Vulnerability Database".
Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perform unauthorized changes on articles where they only have customer permissions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29918 ‼
📖 Read
via "National Vulnerability Database".
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29867 ‼
📖 Read
via "National Vulnerability Database".
Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved in their tickets using the Zammad API.📖 Read
via "National Vulnerability Database".