‼ CVE-2023-3885 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Campcodes Beauty Salon Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/edit_category.php. The manipulation of the argument id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235247.📖 Read
via "National Vulnerability Database".
🦿 How to Create a Custom Security & Threat Dashboard in Power BI 🦿
📖 Read
via "Tech Republic".
Want a custom security dashboard to bring together data from multiple places? Microsoft Power BI can do that and help you spot what's changing.📖 Read
via "Tech Republic".
TechRepublic
How to Create a Custom Security & Threat Dashboard in Power BI
Learn to create custom security and threat dashboards for an overview of multiple data sources in Power BI with this guide.
👍1
📢 Apple patches zero day linked to spyware campaign 📢
📖 Read
via "ITPro".
Kaspersky researchers were the first to report a zero day used in a sophisticated attack chain 📖 Read
via "ITPro".
ITPro
Apple patches zero day linked to spyware campaign
Kaspersky researchers were the first to report a zero day used in a sophisticated attack chain
‼ CVE-2023-2850 ‼
📖 Read
via "National Vulnerability Database".
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23833 ‼
📖 Read
via "National Vulnerability Database".
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Steven Henty Drop Shadow Boxes plugin <=Â 1.7.10 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3486 ‼
📖 Read
via "National Vulnerability Database".
An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage. This could exhaust system resources and prevent the service from operating as expected.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3637 ‼
📖 Read
via "National Vulnerability Database".
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33925 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PluginForage WooCommerce Product Categories Selection Widget plugin <=Â 2.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-35043 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Neha Goel Recent Posts Slider plugin <=Â 1.1 versions.📖 Read
via "National Vulnerability Database".
🛠 jSQL Injection 0.90 🛠
📖 Read
via "Packet Storm Security".
jSQL Injection is a lightweight application used to find database information from a distant server. jSQL Injection is also part of the official penetration testing distribution Kali Linux and is included in various other distributions like Pentest Box, Parrot Security OS, ArchStrike and BlackArch Linux. This is the source code release.📖 Read
via "Packet Storm Security".
Packetstormsecurity
jSQL Injection 0.90 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
‼ CVE-2023-39174 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers📖 Read
via "National Vulnerability Database".
‼ CVE-2023-34017 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FiveStarPlugins Five Star Restaurant Reservations plugin <=Â 2.6.7 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36502 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cththemes Balkon plugin <=Â 1.3.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-34093 ‼
📖 Read
via "National Vulnerability Database".
Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types themselves. Users can use plugins or modify their own content types without realizing that the `privateAttributes` getter is being removed, which can result in any attribute becoming public. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker(having access to password hashes). Anyone can be impacted, depending on how people are using/extending content-types. If the users are mutating the content-type, they will not be affected. Version 4.10.8 contains a patch for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36501 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <=Â 9.0.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39173 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39175 ‼
📖 Read
via "National Vulnerability Database".
In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible📖 Read
via "National Vulnerability Database".
‼ CVE-2023-34369 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <=Â 2.1 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36385 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpxpo PostX – Gutenberg Post Grid Blocks plugin <= 2.9.9 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37895 ‼
📖 Read
via "National Vulnerability Database".
Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI.Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore.In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases.How to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit webapp/standalone.The native RMI protocol by default uses port 1099. To check whether it is enabled, tools like "netstat" can be used to check.RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". So when running standalone on port 8080, check whether an HTTP GET request on localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control.Turning off RMIFind web.xml (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet:    <servlet>      <servlet-name>RMI</servlet-name>      <servlet-class>org.apache.jackrabbit.servlet.remote.RemoteBindingServlet</servlet-class>    </servlet>    <servlet-mapping>      <servlet-name>RMI</servlet-name>      <url-pattern>/rmi</url-pattern>    </servlet-mapping>Find the bootstrap.properties file (in $REPOSITORY_HOME), and set    rmi.enabled=false  and also remove    rmi.host    rmi.port    rmi.url-pattern If there is no file named bootstrap.properties in $REPOSITORY_HOME, it is located somewhere in the classpath. In this case, place a copy in $REPOSITORY_HOME and modify it as explained. 📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36503 ‼
📖 Read
via "National Vulnerability Database".
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin <=Â 9.5.3 versions.📖 Read
via "National Vulnerability Database".