‼ CVE-2023-2909 ‼
📖 Read
via "National Vulnerability Database".
EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below.📖 Read
via "National Vulnerability Database".
👍1
🕴 Salesforce 'Ghost Sites' Expose Sensitive Corporate Data 🕴
📖 Read
via "Dark Reading".
Some companies have moved on from using Salesforce. But without remembering to fully deactivate their clouds, Salesforce won't move on from them.📖 Read
via "Dark Reading".
Dark Reading
Salesforce 'Ghost Sites' Expose Sensitive Corporate Data
Some companies have moved on from using Salesforce. But without remembering to fully deactivate their clouds, Salesforce won't move on from them.
👍1
🕴 Focus Security Efforts on Choke Points, Not Visibility 🕴
📖 Read
via "Dark Reading".
By finding the places where attack paths converge, you can slash multiple exposures in one fix for more efficient remediation.📖 Read
via "Dark Reading".
Dark Reading
Focus Security Efforts on Choke Points, Not Visibility
By finding the places where attack paths converge, you can slash multiple exposures in one fix for more efficient remediation.
👍1
‼ CVE-2023-33508 ‼
📖 Read
via "National Vulnerability Database".
KramerAV VIA GO² < 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote Code Execution (RCE).📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33509 ‼
📖 Read
via "National Vulnerability Database".
KramerAV VIA GO² < 4.0.1.1326 is vulnerable to SQL Injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3009 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33736 ‼
📖 Read
via "National Vulnerability Database".
A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3007 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument sid leads to weak password recovery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230354 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33487 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an attacker to execute arbitrary commands through the "ip" parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3008 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument user/pass leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230355.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33507 ‼
📖 Read
via "National Vulnerability Database".
KramerAV VIA GO² < 4.0.1.1326 is vulnerable to Unauthenticated arbitrary file read.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30285 ‼
📖 Read
via "National Vulnerability Database".
An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted request sent to /rest/synchronizer/1.0/technicalUser.📖 Read
via "National Vulnerability Database".
🕴 Mirai Variant Opens Tenda, Zyxel Gear to RCE, DDoS 🕴
📖 Read
via "Dark Reading".
Researchers have observed several cyberattacks leveraging a botnet called IZ1H9, which exploits vulnerabilities in exposed devices and servers running on Linux.📖 Read
via "Dark Reading".
Dark Reading
Mirai Variant Opens Tenda, Zyxel Gear to RCE, DDoS
Researchers have observed several cyberattacks leveraging a botnet called IZ1H9, which exploits vulnerabilities in exposed devices and servers running on Linux.
‼ CVE-2023-34224 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3014 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, was found in BeipyVideoResolution up to 2.6. Affected is an unknown function of the file admin/admincore.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230358 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
🕴 New eID Scheme Gives EU Citizens Easy Access to Public Services Online 🕴
📖 Read
via "Dark Reading".
The European Commission voted a new electronic identification scheme that creates new opportunities for EU citizens and businesses.📖 Read
via "Dark Reading".
Dark Reading
New eID Scheme Gives EU Citizens Easy Access to Public Services Online
The European Commission voted a new electronic identification scheme that creates new opportunities for EU citizens and businesses.
🕴 Checkmarx Announces GenAI-powered AppSec Platform, Empowering Developers and AppSec Teams to Find and Fix Vulnerabilities Faster 🕴
📖 Read
via "Dark Reading".
Powered by GPT-4, innovative new AI-driven capabilities lower application security (AppSec) risk and help security teams "shift everywhere" with speed and accuracy.📖 Read
via "Dark Reading".
Dark Reading
Checkmarx Announces GenAI-powered AppSec Platform, Empowering Developers and AppSec Teams to Find and Fix Vulnerabilities Faster
Powered by GPT-4, innovative new AI-driven capabilities lower application security (AppSec) risk and help security teams "shift everywhere" with speed and accuracy.
❤1
⚠ Serious Security: That KeePass “master password crack”, and what we can learn from it ⚠
📖 Read
via "Naked Security".
Here, in an admittedly discursive nutshell, is the fascinating story of CVE-2023-32784. (Short version: Don't panic.)📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2023-29747 ‼
📖 Read
via "National Vulnerability Database".
Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Depending on how the data is used, this can result in various attack consequences, such as ad display exceptions.📖 Read
via "National Vulnerability Database".
👍2
‼ CVE-2023-3021 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository mkucej/i-librarian-free prior to 5.10.4.📖 Read
via "National Vulnerability Database".
🕴 Ways to Help Cybersecurity's Essential Workers Avoid Burnout 🕴
📖 Read
via "Dark Reading".
To support and retain the people who protect assets against bad actors, organizations should create a more defensible environment.📖 Read
via "Dark Reading".
Dark Reading
Ways to Help Cybersecurity's Essential Workers Avoid Burnout
To support and retain the people who protect assets against bad actors, organizations should create a more defensible environment.
👍1