‼ CVE-2023-38392 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Hiroaki Miyashita Custom Field Template plugin <=Â 2.5.9 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32090 ‼
📖 Read
via "National Vulnerability Database".
Pega platform clients who are using versions 6.1 through 7.3.1 may beutilizing default credentials📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3896 ‼
📖 Read
via "National Vulnerability Database".
Divide By Zero in vim/vim from 9.0.1367-1 to 9.0.1367-3📖 Read
via "National Vulnerability Database".
🕴 Selling Software to the US Government? Know Security Attestation First 🕴
📖 Read
via "Dark Reading".
Challenging new safety requirements are needed to improve security and work toward a more secure future.📖 Read
via "Dark Reading".
Dark Reading
Selling Software to the US Government? Know Security Attestation First
Challenging new safety requirements are needed to improve security and work toward a more secure future.
⚠ “Crocodile of Wall Street” and her husband plead guilty to giant-sized cryptocrimes ⚠
📖 Read
via "Naked Security".
Sentences still to be decided, but she could get up to 10 years and he could get as many as 20. 📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🕴 Colorado Dept. of Higher Education Hit With Massive Data Breach 🕴
📖 Read
via "Dark Reading".
Last week, the department uncovered a data breach that occurred back in June stemming from what it deems to be a cybersecurity ransomware incident. 📖 Read
via "Dark Reading".
Dark Reading
Colorado Dept. of Higher Education Hit With Massive Data Breach
Last week, the department uncovered a data breach that occurred back in June stemming from what it deems to be a cybersecurity ransomware incident.
‼ CVE-2023-3365 ‼
📖 Read
via "National Vulnerability Database".
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3492 ‼
📖 Read
via "National Vulnerability Database".
The WP Shopping Pages WordPress plugin through 1.14 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0604 ‼
📖 Read
via "National Vulnerability Database".
The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4194 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4147 ‼
📖 Read
via "National Vulnerability Database".
A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3671 ‼
📖 Read
via "National Vulnerability Database".
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4205 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds memory access flaw was found in the Linux kernel’s do_journal_end function when the fails array-index-out-of-bounds in fs/reiserfs/journal.c could happen. This flaw allows a local user to crash the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3650 ‼
📖 Read
via "National Vulnerability Database".
The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3575 ‼
📖 Read
via "National Vulnerability Database".
The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27373 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Due to insufficient input validation, an attacker can tamper with a runtime-accessible EFI variable to cause a dynamic BAR setting to overlap SMRAM.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3524 ‼
📖 Read
via "National Vulnerability Database".
The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24916 ‼
📖 Read
via "National Vulnerability Database".
The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2843 ‼
📖 Read
via "National Vulnerability Database".
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36220 ‼
📖 Read
via "National Vulnerability Database".
Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38795 ‼
📖 Read
via "National Vulnerability Database".
In Gitea through 1.17.1, repo cloning can occur in the migration function.📖 Read
via "National Vulnerability Database".