‼ CVE-2023-33362 ‼
📖 Read
via "National Vulnerability Database".
Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23713 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Manoj Thulasidas Theme Tweaker plugin <=Â 5.20 versions.📖 Read
via "National Vulnerability Database".
🕴 A New Look for Risk in Awareness Training 🕴
📖 Read
via "Dark Reading".
Changes in the way risk is viewed are leading to changes in the way training is conducted.📖 Read
via "Dark Reading".
Dark Reading
A New Look for Risk in Awareness Training
Changes in the way risk is viewed are leading to changes in the way training is conducted.
âš PyPI open-source code repository deals with manic malware maelstrom âš
📖 Read
via "Naked Security".
Controlled outage used to keep malware marauders from gumming up the works. Learn what you can do to help in future...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2023-25474 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Csaba Kissi About Me 3000 widget plugin <=Â 2.2.6 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1209 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts.📖 Read
via "National Vulnerability Database".
🕴 What Security Professionals Need to Know About Aggregate Cyber Risk 🕴
📖 Read
via "Dark Reading".
Widespread cyber incidents will happen, but unlike for natural disasters, specific security controls can help prevent a catastrophe.📖 Read
via "Dark Reading".
Dark Reading
What Security Professionals Need to Know About Aggregate Cyber-Risk
Widespread cyber incidents will happen, but unlike natural disasters, specific security controls can help prevent a catastrophe.
‼ CVE-2023-1837 ‼
📖 Read
via "National Vulnerability Database".
Missing Authentication for critical function vulnerability in HYPR Server allows Authentication Bypass when using Legacy APIs.This issue affects HYPR Server: before 8.0 (with enabled Legacy APIs)📖 Read
via "National Vulnerability Database".
🕴 SuperMailer Abuse Bypasses Email Security for Super-Sized Credential Theft 🕴
📖 Read
via "Dark Reading".
Secure email gateways and end users alike are being fooled by a cyberattack campaign that's enjoying skyrocketing volumes against businesses in every industry, globally.📖 Read
via "Dark Reading".
Dark Reading
SuperMailer Abuse Bypasses Email Security for Super-Sized Credential Theft
Secure email gateways and end users alike are being fooled by a cyberattack campaign that's enjoying skyrocketing volumes against businesses in every industry, globally.
‼ CVE-2023-31518 ‼
📖 Read
via "National Vulnerability Database".
A heap use-after-free in the component CDataFileReader::GetItem of teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) via a crafted map file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-31752 ‼
📖 Read
via "National Vulnerability Database".
SourceCodester Employee and Visitor Gate Pass Logging System v1.0 is vulnerable to SQL Injection via /employee_gatepass/classes/Login.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23298 ‼
📖 Read
via "National Vulnerability Database".
The `Toybox.Graphics.BufferedBitmap.initialize` API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which can result in integer overflows when allocating the underlying bitmap buffer. A malicious application could call the API method with specially crafted parameters and hijack the execution of the device's firmware.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23300 ‼
📖 Read
via "National Vulnerability Database".
The `Toybox.Cryptography.Cipher.initialize` API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can result in buffer overflows when copying data. A malicious application could call the API method with specially crafted parameters and hijack the execution of the device's firmware.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23303 ‼
📖 Read
via "National Vulnerability Database".
The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-31860 ‼
📖 Read
via "National Vulnerability Database".
Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23302 ‼
📖 Read
via "National Vulnerability Database".
The `Toybox.GenericChannel.setDeviceConfig` API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23305 ‼
📖 Read
via "National Vulnerability Database".
The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources. A malicious application embedding specially crafted resources could hijack the execution of the device's firmware.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-31517 ‼
📖 Read
via "National Vulnerability Database".
Teeworlds v0.7.5 was discovered to contain memory leaks.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23304 ‼
📖 Read
via "National Vulnerability Database".
The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toybox.SensorHistory` module without permission. A malicious application could call any functions from the `Toybox.SensorHistory` module without the user's consent and disclose potentially private or sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1508 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adam Retail Automation Systems Mobilmen Terminal Software allows SQL Injection.This issue affects Mobilmen Terminal Software: before 3.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23299 ‼
📖 Read
via "National Vulnerability Database".
The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data such as user profile information and GPS coordinates, among others.📖 Read
via "National Vulnerability Database".