‼ CVE-2023-0160 ‼
📖 Read
via "National Vulnerability Database".
A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2263 ‼
📖 Read
via "National Vulnerability Database".
The Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A is vulnerable to CIP fuzzing. Â The new ENIP connections cannot be established if impacted by this vulnerability, Â which prohibits operational capabilities of the device resulting in a denial-of-service attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33231 ‼
📖 Read
via "National Vulnerability Database".
XSS attack was possible in DPA 2023.2 due to insufficient input validation📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37259 ‼
📖 Read
via "National Vulnerability Database".
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-4428 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.📖 Read
via "National Vulnerability Database".
🦿 E-Waste: Australia’s Hidden ESG Nightmare 🦿
📖 Read
via "Tech Republic".
Australia has an e-waste problem, and for all the conversations around climate change, energy use, plastics and other ESG matters, it's surprising that more isn't said about it.📖 Read
via "Tech Republic".
TechRepublic
E-Waste: Australia's Hidden ESG Nightmare
Despite strides in sustainability, plastics recycling and other ESG matters, Australia lacks effective e-waste recycling standards.
‼ CVE-2023-36670 ‼
📖 Read
via "National Vulnerability Database".
A remotely exploitable command injection vulnerability was found on the Kratos NGC-IDU 9.1.0.4. An attacker can execute arbitrary Linux commands as root by sending crafted TCP requests to the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30383 ‼
📖 Read
via "National Vulnerability Database".
TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707, and TP-LINK Archer C2v1 Archer_C2_US__V1_170228 were discovered to contain a buffer overflow which may lead to a Denial of Service (DoS) when parsing crafted data.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38257 ‼
📖 Read
via "National Vulnerability Database".
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37477 ‼
📖 Read
via "National Vulnerability Database".
1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. 1Panel firewall functionality `/hosts/firewall/ip` endpoint read user input without validation, the attacker extends the default functionality of the application, which execute system commands. An attacker can execute arbitrary code on the target system, which can lead to a complete compromise of the system. This issue has been addressed in commit `e17b80cff49` which is included in release version `1.4.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37480 ‼
📖 Read
via "National Vulnerability Database".
Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unavailability for all users of the Fides webserver. This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading. If an attack occurs, the impact can be mitigated by manually or automatically restarting the affected container.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-34330 ‼
📖 Read
via "National Vulnerability Database".
AMI SPx contains a vulnerability in the BMC where a User may cause a improper control of generation of code by Dynamic Redfish Extension. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability. 📖 Read
via "National Vulnerability Database".
‼ CVE-2020-22159 ‼
📖 Read
via "National Vulnerability Database".
EVERTZ devices 3080IPX exe-guest-v1.2-r26125, 7801FC 1.3 Build 27, and 7890IXG V494 are vulnerable to Arbitrary File Upload, allowing an authenticated attacker to upload a webshell or overwrite any critical system files.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36669 ‼
📖 Read
via "National Vulnerability Database".
Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit (IDU) before 11.4 allows remote attackers to obtain arbitrary control of the IDU/ODU system. Any attacker with layer-3 network access to the IDU can impersonate the Touch Panel Unit (TPU) within the IDU by sending crafted TCP requests to the IDU.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-35763 ‼
📖 Read
via "National Vulnerability Database".
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passwords into plaintext.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33329 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Hijiri Custom Post Type Generator plugin <=Â 2.4.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28019 ‼
📖 Read
via "National Vulnerability Database".
Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37788 ‼
📖 Read
via "National Vulnerability Database".
goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33312 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wppal Easy Captcha plugin <=Â 1.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37481 ‼
📖 Read
via "National Vulnerability Database".
Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (`datastore-connection/new`). This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-35189 ‼
📖 Read
via "National Vulnerability Database".
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it.📖 Read
via "National Vulnerability Database".