‼ CVE-2023-33253 ‼
📖 Read
via "National Vulnerability Database".
LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file (such as shell.jpg.php.shell) being sent.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-34581 ‼
📖 Read
via "National Vulnerability Database".
Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in /php-spms/?page=services/view&id=2📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32961 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Katie Seaborn Zotpress plugin <=Â 7.3.3 versions.📖 Read
via "National Vulnerability Database".
🕴 Supply Chain Attack Defense Demands Mature Threat Hunting 🕴
📖 Read
via "Dark Reading".
Active threat hunting is the best protection against supply chain attacks like MOVEit and 3CX, experts say. 📖 Read
via "Dark Reading".
Dark Reading
Supply Chain Attack Defense Demands Mature Threat Hunting
Active threat hunting is the best protection against supply chain attacks like MOVEit and 3CX, experts say.
🕴 'Stealth Soldier' Attacks Target Libyan Government Entities With Surveillance Malware 🕴
📖 Read
via "Dark Reading".
Surveillance malware targets Libyan government entities, with possible links to a 2019 Egypt attack campaign.📖 Read
via "Dark Reading".
Dark Reading
'Stealth Soldier' Attacks Target Libyan Government Entities With Surveillance Malware
Surveillance malware targets Libyan government entities, with possible links to a 2019 Egypt attack campaign.
⚠ History revisited: US DOJ unseals Mt. Gox cybercrime charges ⚠
📖 Read
via "Naked Security".
Though the mills of the Law grind slowly/Yet they grind exceeding small/Though with patience they stand waiting/With exactness grind they all...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2023-34345 ‼
📖 Read
via "National Vulnerability Database".
AMI BMC contains a vulnerability in the SPX REST API, where anattacker with the required privileges can access arbitrary files, which maylead to information disclosure.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-28933 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in StPeteDesign Call Now Accessibility Button plugin <=Â 1.1 versions.📖 Read
via "National Vulnerability Database".
❤1
🕴 10 Important Security Tasks You Shouldn't Skip 🕴
📖 Read
via "Dark Reading".
Time and money are valuable and finite, but some actions are well worth spending those resources on.📖 Read
via "Dark Reading".
Dark Reading
10 Important Security Tasks You Shouldn't Skip
Time and money are valuable and finite, but some actions are well worth spending those resources on.
‼ CVE-2023-2568 ‼
📖 Read
via "National Vulnerability Database".
The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin📖 Read
via "National Vulnerability Database".
‼ CVE-2023-34334 ‼
📖 Read
via "National Vulnerability Database".
AMI BMC contains a vulnerability in the SPX REST API, where anattacker with the required privileges can inject arbitrary shell commands,which may lead to code execution, denial of service, information disclosure, ordata tampering. 📖 Read
via "National Vulnerability Database".
❤1
🕴 Use of Multifactor Authentication (MFA) Nearly Doubles Since 2020, Okta Secure Sign-in Trends Reports Finds 🕴
📖 Read
via "Dark Reading".
Okta platform data-based study finds FastPass and WebAuthn offer far stronger security and faster, more reliable user experiences.📖 Read
via "Dark Reading".
Dark Reading
Use of Multifactor Authentication (MFA) Nearly Doubles Since 2020, Okta Secure Sign-in Trends Report Finds
Okta platform data-based study finds FastPass and WebAuthn offer far stronger security and faster, more reliable user experiences.
‼ CVE-2023-3161 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33624 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-31472. Reason: This record is a reservation duplicate of CVE-2023-31472. Notes: All CVE users should reference CVE-2023-31472 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.📖 Read
via "National Vulnerability Database".
🕴 Researchers Report First Instance of Automated SaaS Ransomware Extortion 🕴
📖 Read
via "Dark Reading".
The attack highlights growing interest among threat actors to target data from software-as-a-service providers.📖 Read
via "Dark Reading".
Dark Reading
Researchers Report First Instance of Automated SaaS Ransomware Extortion
The attack highlights growing interest among threat actors to target data from software-as-a-service providers.
‼ CVE-2023-26297 ‼
📖 Read
via "National Vulnerability Database".
Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26298 ‼
📖 Read
via "National Vulnerability Database".
Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2277 ‼
📖 Read
via "National Vulnerability Database".
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-33991 ‼
📖 Read
via "National Vulnerability Database".
SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (Stored XSS) vulnerability. After successful exploitation, an attacker with user level access can cause high impact on confidentiality, modify some information and can cause unavailability of the application at user level.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-33124 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V13.3 (All versions < V13.3.0.10), Teamcenter Visualization V14.0 (All versions < V14.0.0.6), Teamcenter Visualization V14.1 (All versions < V14.1.0.8), Teamcenter Visualization V14.2 (All versions < V14.2.0.3). The affected applications contain a memory corruption vulnerability while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33919 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.📖 Read
via "National Vulnerability Database".
❤1