‼ CVE-2023-38310 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log files. This results in the execution of that payload whenever the affected log files are accessed.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38306 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and displays an error message if a prohibited file type is detected. However, by following certain steps, an attacker can bypass these restrictions and inject malicious code.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38311 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the System Logs Viewer functionality. The vulnerability allows an attacker to store a malicious payload in the configuration field, triggering the execution of the payload when saving the configuration or when accessing the System Logs Viewer page.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38308 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Webmin 2.021. A Cross-Site Scripting (XSS) vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code. leading to the execution of arbitrary JavaScript code within the context of the victim's browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36090 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21881 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote attackers to modtify application data via article/admin/content/add.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38305 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when the download link is accessed.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38307 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-35792 ‼
📖 Read
via "National Vulnerability Database".
Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS).📖 Read
via "National Vulnerability Database".
⚠ SEC demands four-day disclosure limit for cybersecurity breaches ⚠
📖 Read
via "Naked Security".
When is a ransomware attack a reportable matter? And how long have you got to decide?📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🛠 RansomLord Anti-Ransomware Exploit Tool 1.0 🛠
📖 Read
via "Packet Storm Security".
RansomLord is a proof-of-concept tool that automates the creation of PE files, used to compromise ransomware pre-encryption. This tool uses dll hijacking to defeat ransomware.📖 Read
via "Packet Storm Security".
Packetstormsecurity
RansomLord Anti-Ransomware ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🔥1
🕴 Call of Duty Self-Spreading Worm Takes Aim at Player Lobbies 🕴
📖 Read
via "Dark Reading".
The revival of the beloved online multiplayer video game was short-lived once players detected unusual activity and behavior that portended malware.📖 Read
via "Dark Reading".
Dark Reading
Call of Duty Self-Spreading Worm Takes Aim at Player Lobbies
The revival of the beloved online multiplayer video game was short-lived once players detected unusual activity and behavior that portended malware.
‼ CVE-2023-4010 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the USB Host Controller Driver framework in the Linux kernel. The usb_giveback_urb function has a logic loophole in its implementation. Due to the inappropriate judgment condition of the goto statement, the function cannot return under the input of a specific malformed descriptor file, so it falls into an endless loop, resulting in a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37771 ‼
📖 Read
via "National Vulnerability Database".
Art Gallery Management System v1.0 contains a SQL injection vulnerability via the cid parameter at /agms/product.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4004 ‼
📖 Read
via "National Vulnerability Database".
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-34916 ‼
📖 Read
via "National Vulnerability Database".
Fuge CMS v1.0 contains an Open Redirect vulnerability via /front/ProcessAct.java.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3997 ‼
📖 Read
via "National Vulnerability Database".
Splunk SOAR versions 6.0.2 and earlier are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3817 ‼
📖 Read
via "National Vulnerability Database".
Issue summary: Checking excessively long DH keys or parameters may be very slow.Impact summary: Applications that use the functions DH_check(), DH_check_ex()or EVP_PKEY_param_check() to check a DH key or DH parameters may experience longdelays. Where the key or parameters that are being checked have been obtainedfrom an untrusted source this may lead to a Denial of Service.The function DH_check() performs various checks on DH parameters. After fixingCVE-2023-3446 it was discovered that a large q parameter value can also triggeran overly long computation during some of these checks. A correct q value,if present, cannot be larger than the modulus p parameter, thus it isunnecessary to perform these checks if q is larger than p.An application that calls DH_check() and supplies a key or parameters obtainedfrom an untrusted source could be vulnerable to a Denial of Service attack.The function DH_check() is itself called by a number of other OpenSSL functions.An application calling any of those other functions may similarly be affected.The other functions affected by this are DH_check_ex() andEVP_PKEY_param_check().Also vulnerable are the OpenSSL dhparam and pkeyparam command line applicationswhen using the "-check" option.The OpenSSL SSL/TLS implementation is not affected by this issue.The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36763 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or editing a post.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4026 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4024. Reason: This record is a duplicate of CVE-2023-4024. Notes: All CVE users should reference CVE-2023-4024 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-34917 ‼
📖 Read
via "National Vulnerability Database".
Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java.📖 Read
via "National Vulnerability Database".