‼ CVE-2022-33065 ‼
📖 Read
via "National Vulnerability Database".
Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c in Libsndfile, allows an attacker to cause Denial of Service or other unspecified impacts.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24390 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WeSecur Security plugin <=Â 1.2.1 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41409 ‼
📖 Read
via "National Vulnerability Database".
Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34123 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered on atasm, version 1.09. A stack-buffer-overflow vulnerability in function aprintf() in asm.c allows attackers to execute arbitrary code on the system via a crafted file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47421 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember (free), Repute InfoSystems ARMember (premium) plugins.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36120 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36384 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodePeople Booking Calendar Contact Form plugin <=Â 1.2.40 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23910 ‼
📖 Read
via "National Vulnerability Database".
Stack-based buffer overflow vulnerability in asn1c through v0.9.28 via function genhash_get in genhash.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30906 ‼
📖 Read
via "National Vulnerability Database".
The vulnerability could be locally exploited to allow escalation of privilege.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32965 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CRUDLab Jazz Popups plugin <=Â 1.8.7 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36383 ‼
📖 Read
via "National Vulnerability Database".
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <=Â 3.9.5 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-31441 ‼
📖 Read
via "National Vulnerability Database".
In NATO Communications and Information Agency anet (aka Advisor Network) through 3.3.0, an attacker can provide a crafted JSON file to sanitizeJson and cause an exception. This is related to the U+FFFD Unicode replacement character. A for loop does not consider that a data structure is being modified during loop execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23911 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in asn1c through v0.9.28. A NULL pointer dereference exists in the function _default_error_logger() located in asn1fix.c. It allows an attacker to cause Denial of Service.📖 Read
via "National Vulnerability Database".
⚠ Microsoft hit by Storm season – a tale of two semi-zero days ⚠
📖 Read
via "Naked Security".
The first compromise didn't get the crooks as far as they wanted, so they found a second one that did...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2023-34035 ‼
📖 Read
via "National Vulnerability Database".
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. (DispatcherServlet is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)Specifically, an application is vulnerable when all of the following are true: * Spring MVC is on the classpath * Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet) * The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpointsAn application is not vulnerable if any of the following is true: * The application does not have Spring MVC on the classpath * The application secures no servlets other than Spring MVC’s DispatcherServlet * The application uses requestMatchers(String) only for Spring MVC endpoints📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33265 ‼
📖 Read
via "National Vulnerability Database".
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0160 ‼
📖 Read
via "National Vulnerability Database".
A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2263 ‼
📖 Read
via "National Vulnerability Database".
The Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A is vulnerable to CIP fuzzing. Â The new ENIP connections cannot be established if impacted by this vulnerability, Â which prohibits operational capabilities of the device resulting in a denial-of-service attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33231 ‼
📖 Read
via "National Vulnerability Database".
XSS attack was possible in DPA 2023.2 due to insufficient input validation📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37259 ‼
📖 Read
via "National Vulnerability Database".
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-4428 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.📖 Read
via "National Vulnerability Database".