🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.9K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.9K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-30185 ‼

CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.

📖 Read

via "National Vulnerability Database".
👍1
725 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-30018 ‼

Judging Management System v1.0 is vulnerable to SQL Injection. via /php-jms/review_se_result.php?mainevent_id=.

📖 Read

via "National Vulnerability Database".
752 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-30257 ‼

A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root.

📖 Read

via "National Vulnerability Database".
752 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-29944 ‼

Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet function of the metersphere system workbench

📖 Read

via "National Vulnerability Database".
👍1
707 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-29247 ‼

Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0.

📖 Read

via "National Vulnerability Database".
630 views
🛡 Cybersecurity & Privacy 🛡 - News
🕴 North Korean APT Uses Malicious Microsoft OneDrive Links to Spread New Malware 🕴

ReconShark, aimed at gaining initial access to targeted systems, is a component of previous malware used by the Kimsuky group.

📖 Read

via "Dark Reading".
Dark Reading
North Korean APT Uses Malicious Microsoft OneDrive Links to Spread New Malware
ReconShark, aimed at gaining initial access to targeted systems, is a component of previous malware used by the Kimsuky group.
👍1
595 views
🛡 Cybersecurity & Privacy 🛡 - News
🕴 Why the FTX Collapse Was an Identity Problem 🕴

Cryptocurrency has a valuable role to play in a Web3 world — but only if the public can fully trust it.

📖 Read

via "Dark Reading".
Dark Reading
Why the FTX Collapse Was an Identity Problem
Cryptocurrency has a valuable role to play in a Web3 world — but only if the public can fully trust it.
477 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-25052 ‼

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa Yandex.News Feed by Teplitsa plugin <= 1.12.5 versions.

📖 Read

via "National Vulnerability Database".
356 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-2575 ‼

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stack-based Buffer Overflow vulnerability, which can be triggered by authenticated users via a crafted POST request.

📖 Read

via "National Vulnerability Database".
344 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-25452 ‼

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Pretty (prettyboymp) CMS Press plugin <= 0.2.3 versions.

📖 Read

via "National Vulnerability Database".
332 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-2574 ‼

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be triggered by authenticated users via a crafted POST request.

📖 Read

via "National Vulnerability Database".
301 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-25754 ‼

Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0.

📖 Read

via "National Vulnerability Database".
289 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-45812 ‼

Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Lees Exxp plugin <= 2.6.8 versions.

📖 Read

via "National Vulnerability Database".
291 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-2573 ‼

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be triggered by authenticated users via a crafted POST request.

📖 Read

via "National Vulnerability Database".
288 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-46799 ‼

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form plugin <= 1.0.15 versions.

📖 Read

via "National Vulnerability Database".
294 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-28169 ‼

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CoreFortress Easy Event calendar plugin <= 1.0 versions.

📖 Read

via "National Vulnerability Database".
301 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-23668 ‼

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in GiveWP plugin <= 2.25.1 versions.

📖 Read

via "National Vulnerability Database".
305 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-25021 ‼

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FareHarbor FareHarbor for WordPress plugin <= 3.6.6 versions.

📖 Read

via "National Vulnerability Database".
318 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-1651 ‼

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS

📖 Read

via "National Vulnerability Database".
293 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-0537 ‼

The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

📖 Read

via "National Vulnerability Database".
285 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-22790 ‼

Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

📖 Read

via "National Vulnerability Database".
222 views