🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4169 ‼

A vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/sys/set_passwd of the component Administrator Password Handler. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-236185 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

📖 Read

via "National Vulnerability Database".
480 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4187 ‼

Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

📖 Read

via "National Vulnerability Database".
👍1
372 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4168 ‼

A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of the component Redirect Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

📖 Read

via "National Vulnerability Database".
368 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-36678 ‼

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <= 3.5.5 versions.

📖 Read

via "National Vulnerability Database".
332 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4172 ‼

A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This issue affects some unknown processing of the file \Service\FileHandler.ashx. The manipulation of the argument FileDirectory leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236207.

📖 Read

via "National Vulnerability Database".
👍1
335 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-36686 ‼

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CartFlows Pro plugin <= 1.11.11 versions.

📖 Read

via "National Vulnerability Database".
307 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-30491 ‼

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.8 versions.

📖 Read

via "National Vulnerability Database".
296 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-37873 ‼

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.

📖 Read

via "National Vulnerability Database".
321 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-34377 ‼

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joseph C Dolson My Content Management plugin <= 1.7.6 versions.

📖 Read

via "National Vulnerability Database".
363 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-36689 ‼

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFactory WPFactory Helper plugin <= 1.5.2 versions.

📖 Read

via "National Vulnerability Database".
👍1
425 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-37874 ‼

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dimitar Ivanov HTTP Headers plugin <= 1.18.11 versions.

📖 Read

via "National Vulnerability Database".
👍1
436 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-34010 ‼

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in submodule of David Lingren Media Library Assistant plugin  <= 3.0.7 versions.

📖 Read

via "National Vulnerability Database".
👍1
467 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4180 ‼

A vulnerability classified as critical was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this vulnerability is an unknown functionality of the file /vm/login.php. The manipulation of the argument useremail/userpassword leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236215.

📖 Read

via "National Vulnerability Database".
👍1
406 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-37581 ‼

Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.2 and you should disable Roller's File Upload feature.?

📖 Read

via "National Vulnerability Database".
415 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4181 ‼

A vulnerability, which was classified as critical, has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this issue is some unknown functionality of the file /vm/admin/delete-doctor.php?id=2 of the component Redirect Handler. The manipulation leads to enforcement of behavioral workflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-236216.

📖 Read

via "National Vulnerability Database".
371 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4179 ‼

A vulnerability classified as critical has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected is an unknown function of the file /vm/doctor/doctors.php?action=view. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-236214 is the identifier assigned to this vulnerability.

📖 Read

via "National Vulnerability Database".
448 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4177 ‼

A vulnerability was found in EmpowerID up to 7.205.0.0. It has been rated as problematic. This issue affects some unknown processing of the component Multi-Factor Authentication Code Handler. The manipulation leads to information disclosure. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 7.205.0.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-236213 was assigned to this vulnerability.

📖 Read

via "National Vulnerability Database".
508 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4184 ‼

A vulnerability was found in SourceCodester Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file sell_return.php. The manipulation of the argument pid leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-236219.

📖 Read

via "National Vulnerability Database".
540 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4185 ‼

A vulnerability was found in SourceCodester Online Hospital Management System 1.0. It has been classified as critical. Affected is an unknown function of the file patientlogin.php. The manipulation of the argument loginid/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-236220.

📖 Read

via "National Vulnerability Database".
619 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4195 ‼

PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

📖 Read

via "National Vulnerability Database".
❤1
550 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4196 ‼

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

📖 Read

via "National Vulnerability Database".
571 views