🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-27613 ‼

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MonitorClick Forms Ada – Form Builder plugin <= 1.0 versions.

📖 Read

via "National Vulnerability Database".
667 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-2962 ‼

A vulnerability, which was classified as critical, has been found in SourceCodester Faculty Evaluation System 1.0. Affected by this issue is some unknown functionality of the file index.php?page=edit_user. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230150 is the identifier assigned to this vulnerability.

📖 Read

via "National Vulnerability Database".
👍1
689 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-32696 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.

📖 Read

via "National Vulnerability Database".
620 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-32711 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.

📖 Read

via "National Vulnerability Database".
580 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-32735 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.

📖 Read

via "National Vulnerability Database".
549 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-32722 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.

📖 Read

via "National Vulnerability Database".
468 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-32677 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.

📖 Read

via "National Vulnerability Database".
464 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-32718 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.

📖 Read

via "National Vulnerability Database".
453 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-32689 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.

📖 Read

via "National Vulnerability Database".
460 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-24631 ‼

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is stored XSS via the ajaxTenants.php desc parameter.

📖 Read

via "National Vulnerability Database".
440 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-24627 ‼

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.

📖 Read

via "National Vulnerability Database".
453 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-24580 ‼

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-24580. Reason: This candidate is a duplicate of CVE-2023-24580. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2023-24580 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

📖 Read

via "National Vulnerability Database".
487 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-30571 ‼

Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.

📖 Read

via "National Vulnerability Database".
549 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2014-125102 ‼

A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown functionality of the component Thumbnail Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 1.0.8 is able to address this issue. The name of the patch is 860d1891025548cf0f5f97364c1f51a888f523c3. It is recommended to upgrade the affected component. The identifier VDB-230113 was assigned to this vulnerability.

📖 Read

via "National Vulnerability Database".
591 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-32698 ‼

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files (without extra config for enforcing it’s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creating packages without checking/setting file permissions before packaging could result in bad permissions for files/folders.

📖 Read

via "National Vulnerability Database".
🔥1
603 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-27988 ‼

The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely.

📖 Read

via "National Vulnerability Database".
🔥1
629 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-33245 ‼

Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution, via crafted world data that contains a symlink.

📖 Read

via "National Vulnerability Database".
583 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-0443 ‼

The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked.

📖 Read

via "National Vulnerability Database".
603 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-2972 ‼

Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.

📖 Read

via "National Vulnerability Database".
589 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-45853 ‼

** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

📖 Read

via "National Vulnerability Database".
574 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-33234 ‼

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner.  Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.

📖 Read

via "National Vulnerability Database".
599 views