‼ CVE-2022-43681 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (or the option length word, in case of an extended OPEN message), the FRR code reads of out of the bounds of the packet, throwing a SIGABRT signal and exiting. This results in a bgpd daemon restart, causing a Denial-of-Service condition.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23820 ‼
📖 Read
via "National Vulnerability Database".
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <=Â 4.5.4 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25796 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Include WP BaiDu Submit plugin <=Â 1.2.1 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25798 ‼
📖 Read
via "National Vulnerability Database".
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Olevmedia Olevmedia Shortcodes plugin <=Â 1.1.9 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40318 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case. NOTE: this behavior occurs in bgp_open_option_parse in the bgp_open.c file, a different location (with a different attack vector) relative to CVE-2022-40302.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1383 ‼
📖 Read
via "National Vulnerability Database".
An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible.This issue affects:Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23708 ‼
📖 Read
via "National Vulnerability Database".
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin <=Â 3.9.4 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1384 ‼
📖 Read
via "National Vulnerability Database".
The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be runThis issue affects:Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5.Insignia TV with FireOS versions prior to 7.6.3.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1385 ‼
📖 Read
via "National Vulnerability Database".
Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services.This issue affects:Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5.Insignia TV with FireOS 7.6.3.3.📖 Read
via "National Vulnerability Database".
🕴 Anatomy of a Malicious Package Attack 🕴
📖 Read
via "Dark Reading".
Malicious packages are hard to avoid and hard to detect — unless you know what to look for.📖 Read
via "Dark Reading".
Dark Reading
Anatomy of a Malicious Package Attack
Malicious packages are hard to avoid and hard to detect — unless you know what to look for.
‼ CVE-2023-26017 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <=Â 2.5.10.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23875 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Himanshu Bing Site Verification plugin using Meta Tag plugin <=Â 1.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23881 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GreenTreeLabs Circles Gallery plugin <=Â 1.0.10 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25967 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo plugin <=Â 6.0.2.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23830 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <=Â 4.5.4 versions.📖 Read
via "National Vulnerability Database".
🕴 What's the Secret to Finding the Next Big Thing in Cybersecurity? 🕴
📖 Read
via "Dark Reading".
Varun Badhwar, who has brought each of the three startups he founded to the finals of the RSAC Innovation Sandbox, talks about how to see around the corner.📖 Read
via "Dark Reading".
Dark Reading
What's the Secret to Finding the Next Big Thing in Cybersecurity?
Varun Badhwar, who has brought each of the three startups he founded to the finals of the RSAC Innovation Sandbox, talks about how to see around the corner.
🕴 Court Rejects Merck Insurers' Attempt to Refuse Coverage for NotPetya Damages 🕴
📖 Read
via "Dark Reading".
Insurers unsuccessfully argued Merck's $1.4B in losses following NotPetya cyberattack fell under wartime exclusion. 📖 Read
via "Dark Reading".
Dark Reading
Court Rejects Merck Insurers' Attempt to Refuse Coverage for NotPetya Damages
Insurers unsuccessfully argued Merck's $1.4B in losses following NotPetya cyberattack fell under wartime exclusion.
👍1
⚠ Tracked by hidden tags? Apple and Google unite to propose safety and security standards… ⚠
📖 Read
via "Naked Security".
To bleat, or not to bleat, that is the question.📖 Read
via "Naked Security".
Naked Security
Tracked by hidden tags? Apple and Google unite to propose safety and security standards…
To bleat, or not to bleat, that is the question.
‼ CVE-2023-25827 ‼
📖 Read
via "National Vulnerability Database".
Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a reflected XSS vulnerability with the suggestion endpoint.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25826 ‼
📖 Read
via "National Vulnerability Database".
Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was previously disclosed as CVE-2020-35476. Regex validation that was implemented to restrict allowed input to the query API does not work as intended, allowing crafted commands to bypass validation.📖 Read
via "National Vulnerability Database".
🕴 DNA Sequencing Equipment Vulnerability Adds New Twist to Medical Device Cyber Threats 🕴
📖 Read
via "Dark Reading".
A vulnerability in a DNA sequencer highlights the expanded attack surface area of healthcare organizations but also shows that reporting of medical device vulnerabilities works.📖 Read
via "Dark Reading".
Dark Reading
DNA Sequencing Equipment Vulnerability Adds New Twist to Medical Device Cyber Threats
A vulnerability in a DNA sequencer highlights the expanded attack surface area of healthcare organizations but also shows that reporting of medical device vulnerabilities works.