🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.9K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.9K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-31047 ‼

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.

📖 Read

via "National Vulnerability Database".
830 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-32290 ‼

The myMail app through 14.30 for iOS sends cleartext credentials in a situation where STARTTLS is expected by a server.

📖 Read

via "National Vulnerability Database".
806 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-2564 ‼

OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0.

📖 Read

via "National Vulnerability Database".
748 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-2565 ‼

A vulnerability has been found in SourceCodester Multi Language Hotel Management Software 1.0 and classified as problematic. This vulnerability affects unknown code of the file ajax.php of the component POST Parameter Handler. The manipulation of the argument complaint_type with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228172.

📖 Read

via "National Vulnerability Database".
849 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-30185 ‼

CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.

📖 Read

via "National Vulnerability Database".
👍1
725 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-30018 ‼

Judging Management System v1.0 is vulnerable to SQL Injection. via /php-jms/review_se_result.php?mainevent_id=.

📖 Read

via "National Vulnerability Database".
752 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-30257 ‼

A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root.

📖 Read

via "National Vulnerability Database".
752 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-29944 ‼

Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet function of the metersphere system workbench

📖 Read

via "National Vulnerability Database".
👍1
707 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-29247 ‼

Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0.

📖 Read

via "National Vulnerability Database".
630 views
🛡 Cybersecurity & Privacy 🛡 - News
🕴 North Korean APT Uses Malicious Microsoft OneDrive Links to Spread New Malware 🕴

ReconShark, aimed at gaining initial access to targeted systems, is a component of previous malware used by the Kimsuky group.

📖 Read

via "Dark Reading".
Dark Reading
North Korean APT Uses Malicious Microsoft OneDrive Links to Spread New Malware
ReconShark, aimed at gaining initial access to targeted systems, is a component of previous malware used by the Kimsuky group.
👍1
595 views
🛡 Cybersecurity & Privacy 🛡 - News
🕴 Why the FTX Collapse Was an Identity Problem 🕴

Cryptocurrency has a valuable role to play in a Web3 world — but only if the public can fully trust it.

📖 Read

via "Dark Reading".
Dark Reading
Why the FTX Collapse Was an Identity Problem
Cryptocurrency has a valuable role to play in a Web3 world — but only if the public can fully trust it.
477 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-25052 ‼

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa Yandex.News Feed by Teplitsa plugin <= 1.12.5 versions.

📖 Read

via "National Vulnerability Database".
356 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-2575 ‼

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stack-based Buffer Overflow vulnerability, which can be triggered by authenticated users via a crafted POST request.

📖 Read

via "National Vulnerability Database".
344 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-25452 ‼

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Pretty (prettyboymp) CMS Press plugin <= 0.2.3 versions.

📖 Read

via "National Vulnerability Database".
332 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-2574 ‼

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be triggered by authenticated users via a crafted POST request.

📖 Read

via "National Vulnerability Database".
301 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-25754 ‼

Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0.

📖 Read

via "National Vulnerability Database".
289 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-45812 ‼

Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Lees Exxp plugin <= 2.6.8 versions.

📖 Read

via "National Vulnerability Database".
291 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-2573 ‼

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be triggered by authenticated users via a crafted POST request.

📖 Read

via "National Vulnerability Database".
288 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-46799 ‼

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form plugin <= 1.0.15 versions.

📖 Read

via "National Vulnerability Database".
294 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-28169 ‼

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CoreFortress Easy Event calendar plugin <= 1.0 versions.

📖 Read

via "National Vulnerability Database".
301 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-23668 ‼

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in GiveWP plugin <= 2.25.1 versions.

📖 Read

via "National Vulnerability Database".
305 views