⚠ Serious Security: Rowhammer returns to gaslight your computer ⚠
📖 Read
via "Naked Security".
Gaslights produce a telltale flicker when nearby lamps are lit; DRAM values do something similar when nearby memory cells are accessed.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
👍1
‼ CVE-2023-24489 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30960 ‼
📖 Read
via "National Vulnerability Database".
A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further intervention is required.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3608 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Ruijie BCR810W 2.5.10. It has been rated as critical. This issue affects some unknown processing of the component Tracert Page. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233477 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30956 ‼
📖 Read
via "National Vulnerability Database".
A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24490 ‼
📖 Read
via "National Vulnerability Database".
Users with only access to launch VDA applications can launch an unauthorized desktop📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30963 ‼
📖 Read
via "National Vulnerability Database".
A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affected Foundry instances. No further intervention is required.📖 Read
via "National Vulnerability Database".
🕴 'ScarletEel' Hackers Worm Into AWS Cloud 🕴
📖 Read
via "Dark Reading".
A toolset upgrade is making ScarletEel more slippery than ever while it continues to manipulate the cloud to perform cryptojacking, DDoS, and more.📖 Read
via "Dark Reading".
Dark Reading
'ScarletEel' Hackers Worm Into AWS Cloud
A toolset upgrade is making ScarletEel more slippery than ever while it continues to manipulate the cloud to perform cryptojacking, DDoS, and more.
‼ CVE-2023-23731 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in HasTheme WishSuite plugin <=Â 1.3.3 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25468 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Reservation.Studio Reservation.Studio widget plugin <=Â 1.0.11 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23777 ‼
📖 Read
via "National Vulnerability Database".
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.18 and below may allow a privileged attacker to execute arbitrary bash commands via crafted cli backup parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-31191 ‼
📖 Read
via "National Vulnerability Database".
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection.An attacker can exploit this vulnerability by injecting, on carefully selected channels, high power spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information.This issue affects the adjacent channel suppression algorithm present in DroneScout ds230 firmware from version 20211210-1627 through 20230329-1042.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22302 ‼
📖 Read
via "National Vulnerability Database".
A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-35913 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in OOPSpam OOPSpam Anti-Spam plugin <=Â 1.1.44 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-31190 ‼
📖 Read
via "National Vulnerability Database".
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an Improper Authentication vulnerability during the firmware update procedure.Specifically, the firmware update procedure ignores and does not check the validity of the TLS certificate of the HTTPS endpoint from which the firmware update package (.tar.bz2 file) is downloaded.An attacker with the ability to put himself in a Man-in-the-Middle situation (e.g., DNS poisoning, ARP poisoning, control of a node on the route to the endpoint, etc.) can trick the DroneScout ds230 to install a crafted malicious firmware update containing arbitrary files (e.g., executable and configuration) and gain administrative (root) privileges on the underlying Linux operating system.This issue affects DroneScout ds230 firmware from version 20211210-1627 through 20230329-1042.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36517 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Kevon Adonis WP Abstracts plugin <=Â 2.6.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1936 ‼
📖 Read
via "National Vulnerability Database".
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the email address of a user who created a service desk issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-45823 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in GalleryPlugins Video Contest WordPress plugin <=Â 3.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25051 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Denishua Comment Reply Notification plugin <=Â 1.4 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23997 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <=Â 1.2.7 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29156 ‼
📖 Read
via "National Vulnerability Database".
DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection.An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which force the DroneScout ds230 Remote ID receiver to drop real Remote ID (RID) information and, instead, generate and transmit JSON encoded MQTT messages containing crafted RID information. Consequently, the MQTT broker, typically operated by a system integrator, will have no access to the drones’ real RID information.This issue affects DroneScout ds230 in default configuration from firmware version 20211210-1627 through 20230329-1042.📖 Read
via "National Vulnerability Database".