‼ CVE-2023-34103 ‼
📖 Read
via "National Vulnerability Database".
Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting (XSS) when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are stored and no specific timing is required. This issue has been addressed in commit `7891c01e` which is expected to be included in the next release of avo. Users are advised to configure CSP headers for their application and to limit untrusted user access as a mitigation.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48181 ‼
📖 Read
via "National Vulnerability Database".
An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access to elevate their privileges and execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22450 ‼
📖 Read
via "National Vulnerability Database".
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a webserver when logged in as manager user, which can lead to arbitrary code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32628 ‼
📖 Read
via "National Vulnerability Database".
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to ASP when uploading it, which can lead to remote code execution.📖 Read
via "National Vulnerability Database".
⚠ MOVEit zero-day exploit used by data breach gangs: The how, the why, and what to do… ⚠
📖 Read
via "Naked Security".
Little Bobby Tables is back!📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2022-48441 ‼
📖 Read
via "National Vulnerability Database".
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33230 ‼
📖 Read
via "National Vulnerability Database".
Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30863 ‼
📖 Read
via "National Vulnerability Database".
In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21670 ‼
📖 Read
via "National Vulnerability Database".
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.📖 Read
via "National Vulnerability Database".
🕴 ChatGPT Hallucinations Open Developers to Supply-Chain Malware Attacks 🕴
📖 Read
via "Dark Reading".
Attackers could exploit a common AI experience—false recommendations—to spread malicious code via developers that use ChatGPT to create software.📖 Read
via "Dark Reading".
Dark Reading
ChatGPT Hallucinations Open Developers to Supply Chain Malware Attacks
Attackers could exploit a common AI experience — false recommendations — to spread malicious code via developers that use ChatGPT to create software.
‼ CVE-2023-1779 ‼
📖 Read
via "National Vulnerability Database".
Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions <=2.13.3 allow an authorized remote attacker with low privileges to view a limited amount of another accounts contact information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2833 ‼
📖 Read
via "National Vulnerability Database".
The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the 'rx_set_screen_options' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_screen_options[option]' and 'wp_screen_options[value]' parameters during a screen option update.📖 Read
via "National Vulnerability Database".
🕴 US Aerospace Contractor Hacked With 'PowerDrop' Backdoor 🕴
📖 Read
via "Dark Reading".
Hackers used a little to do a lot, cracking a high-value target with hardly more than the living-off-the-land tools (PowerShell especially) found on any standard Windows computer.📖 Read
via "Dark Reading".
Dark Reading
US Aerospace Contractor Hacked With 'PowerDrop' Backdoor
Hackers used a little to do a lot, cracking a high-value target with hardly more than the living-off-the-land tools (PowerShell especially) found on any standard Windows computer.
❤2
🕴 Filling the Gaps: How to Secure the Future of Hybrid Work 🕴
📖 Read
via "Dark Reading".
By enhancing remote management and adopting hardware-enforced security, productivity can continue without inviting extra cyber-risk.📖 Read
via "Dark Reading".
Dark Reading
Filling the Gaps: How to Secure the Future of Hybrid Work
By enhancing remote management and adopting hardware-enforced security, productivity can continue without inviting extra cyber-risk.
‼ CVE-2023-20724 ‼
📖 Read
via "National Vulnerability Database".
In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07843845; Issue ID: ALPS07843841.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-20733 ‼
📖 Read
via "National Vulnerability Database".
In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID: ALPS07645149.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-20747 ‼
📖 Read
via "National Vulnerability Database".
In vcu, there is a possible memory corruption due to type confusion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519103; Issue ID: ALPS07519121.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33532 ‼
📖 Read
via "National Vulnerability Database".
There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can inject commands into the post request parameters, thereby gaining shell privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30948 ‼
📖 Read
via "National Vulnerability Database".
A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment UUID into other arbitrary comments to discover it's content.This defect was fixed in Foundry Comments 2.249.0, and a patch was rolled out to affected Foundry environments. No further intervention is required at this time.📖 Read
via "National Vulnerability Database".
⚠ Chrome zero-day: “This exploit is in the wild”, so check your version now ⚠
📖 Read
via "Naked Security".
Chrome 0-day patched now, Edge patch coming soon.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2023-0921 ‼
📖 Read
via "National Vulnerability Database".
A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.📖 Read
via "National Vulnerability Database".