‼ CVE-2023-26449 ‼
📖 Read
via "National Vulnerability Database".
The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We are now defining the accepted media-type to avoid code execution. No publicly available exploits are known.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26451 ‼
📖 Read
via "National Vulnerability Database".
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.📖 Read
via "National Vulnerability Database".
📢 Data breach costs: Businesses lose 73% of their income in the year following an incident 📢
📖 Read
via "ITPro".
Erosion of trust, remediation costs, and potential regulatory fines create a confluence of financial burdens for businesses 📖 Read
via "ITPro".
ITPro
Data breach costs: Businesses lose 73% of their income in the year following an incident
Erosion of trust, remediation costs, and potential regulatory fines create a confluence of financial burdens for businesses
❤1
‼ CVE-2023-33383 ‼
📖 Read
via "National Vulnerability Database".
Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a device reload.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38330 ‼
📖 Read
via "National Vulnerability Database".
OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40609 ‼
📖 Read
via "National Vulnerability Database".
IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236069.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-33257 ‼
📖 Read
via "National Vulnerability Database".
Verint Engagement Management 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23476 ‼
📖 Read
via "National Vulnerability Database".
IBM Robotic Process Automation 21.0.0 through 21.0.7.latest is vulnerable to unauthorized access to data due to insufficient authorization validation on some API routes. IBM X-Force ID: 245425.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-26317 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been discovered in Xiaomi routers that could allow command injection through an external interface. This vulnerability arises from inadequate filtering of responses returned from the external interface. Attackers could exploit this vulnerability by hijacking the ISP or an upper-layer router to gain privileges on the Xiaomi router. Successful exploitation of this flaw could permit remote code execution and complete compromise of the device.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-46484 ‼
📖 Read
via "National Vulnerability Database".
Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26316 ‼
📖 Read
via "National Vulnerability Database".
A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-46485 ‼
📖 Read
via "National Vulnerability Database".
Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Field" or "Contact Details".📖 Read
via "National Vulnerability Database".
🕴 Cyber-Insurance Underwriting Is Still Stuck in the Dark Ages 🕴
📖 Read
via "Dark Reading".
Innovations in continuous controls monitoring may be the only way underwriters can offer cyber-insurance policies that make sense in the market. 📖 Read
via "Dark Reading".
Dark Reading
Cyber-Insurance Underwriting Is Still Stuck in the Dark Ages
Innovations in continuous controls monitoring may be the only way underwriters can offer cyber-insurance policies that make sense in the market.
‼ CVE-2023-3470 ‼
📖 Read
via "National Vulnerability Database".
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. Â The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information required to generate the correct password. Â On vCMP systems, all Guests share the same deterministic password, allowing those with TMSH access on one Guest to access keys of a different Guest.The following BIG-IP hardware platforms are affected: 10350v-F, i5820-DF, i7820-DF, i15820-DF, 5250v-F, 7200v-F, 10200v-F, 6900-F, 8900-F, 11000-F, and 11050-F.The BIG-IP rSeries r5920-DF and r10920-DF are not affected, nor does the issue affect software FIPS implementations or network HSM configurations.Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38423 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38419 ‼
📖 Read
via "National Vulnerability Database".
An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38138 ‼
📖 Read
via "National Vulnerability Database".
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36494 ‼
📖 Read
via "National Vulnerability Database".
Audit logs on F5OS-A may contain undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36858 ‼
📖 Read
via "National Vulnerability Database".
An insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may allow an attacker to modify its configured server list.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38418 ‼
📖 Read
via "National Vulnerability Database".
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.📖 Read
via "National Vulnerability Database".
👍1
🕴 Iranian Company Plays Host to Reams of Ransomware, APT Groups 🕴
📖 Read
via "Dark Reading".
Cloudzy is a command-and-control provider (C2P) to APT groups in Iran, North Korea, and Russia, according to Halcyon.📖 Read
via "Dark Reading".
Dark Reading
Iranian Company Plays Host to Reams of Ransomware, APT Groups
Cloudzy is a command-and-control provider (C2P) to APT groups in Iran, North Korea, and Russia, according to Halcyon.