‼ CVE-2023-28535 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Paytm Paytm Payment Donation plugin <=Â 2.2.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30489 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Email Subscription Popup plugin <=Â 1.2.16 versions.📖 Read
via "National Vulnerability Database".
🕴 Health Data of 4M Stolen in Cl0p MOVEit Breach of Colorado Department 🕴
📖 Read
via "Dark Reading".
State's Department of Health Care Policy & Financing is the latest to acknowledge an attack by the Russian group's ongoing exploitation of third-party systems.📖 Read
via "Dark Reading".
Dark Reading
Health Data of 4M Stolen in Cl0p MOVEit Breach of Colorado Department
State's Department of Health Care Policy & Financing is the latest to acknowledge an attack by the Russian group's ongoing exploitation of third-party systems.
🛠 jSQL Injection 0.91 🛠
📖 Read
via "Packet Storm Security".
jSQL Injection is a lightweight application used to find database information from a distant server. jSQL Injection is also part of the official penetration testing distribution Kali Linux and is included in various other distributions like Pentest Box, Parrot Security OS, ArchStrike and BlackArch Linux. This is the source code release.📖 Read
via "Packet Storm Security".
Packetstormsecurity
jSQL Injection 0.91 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
‼ CVE-2023-40359 ‼
📖 Read
via "National Vulnerability Database".
xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28768 ‼
📖 Read
via "National Vulnerability Database".
Improper frame handling in the Zyxel XGS2220-30 firmware version V4.80(ABXN.1), XMG1930-30 firmware version V4.80(ACAR.1), and XS1930-10 firmware version V4.80(ABQE.1) could allow an unauthenticated LAN-based attacker to cause denial-of-service (DoS) conditions by sending crafted frames to an affected switch.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33013 ‼
📖 Read
via "National Vulnerability Database".
A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40354 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4322 ‼
📖 Read
via "National Vulnerability Database".
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.📖 Read
via "National Vulnerability Database".
🦿 Massive EvilProxy Phishing Attack Campaign Bypasses 2FA, Targets Top-Level Executives 🦿
📖 Read
via "Tech Republic".
This attack sent approximately 120,000 phishing emails to organizations worldwide with the goal to steal Microsoft 365 credentials.📖 Read
via "Tech Republic".
TechRepublic
Massive EvilProxy Phishing Attack Campaign Bypasses 2FA, Targets Top-Level Executives
This attack sent approximately 120,000 phishing emails to organizations worldwide with the goal to steal Microsoft 365 credentials.
🕴 Russian-African Security Gathering Exposes Kremlin's Reduced Influence 🕴
📖 Read
via "Dark Reading".
Messaging from joint summit in Saint Petersburg amounts to little more than "diplomatic subterfuge," observers note.📖 Read
via "Dark Reading".
Dark Reading
Russian-African Security Gathering Exposes Kremlin's Reduced Influence
Messaging from joint summit in Saint Petersburg amounts to little more than "diplomatic subterfuge," observers note.
🕴 What's New in the NIST Cybersecurity Framework 2.0 🕴
📖 Read
via "Dark Reading".
Update to the NIST framework adds new "govern" function for cybersecurity.📖 Read
via "Dark Reading".
Dark Reading
What's New in the NIST Cybersecurity Framework 2.0
Update to the NIST framework adds new "govern" function for cybersecurity.
‼ CVE-2023-39293 ‼
📖 Read
via "National Vulnerability Database".
A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute arbitrary commands within the context of the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38721 ‼
📖 Read
via "National Vulnerability Database".
The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor could gain access to a command line with elevated privileges allowing root access to the host operating system. IBM X-Force ID: 262173.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40312 ‼
📖 Read
via "National Vulnerability Database".
Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that an attacker can modify to craft a malicious XSS payload. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29468 ‼
📖 Read
via "National Vulnerability Database".
The Texas Instruments (TI) WiLink WL18xx MCP driver does not limit the number of information elements (IEs) of type XCC_EXT_1_IE_ID or XCC_EXT_2_IE_ID that can be parsed in a management frame. Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code execution. This affects WILINK8-WIFI-MCP8 version 8.5_SP3 and earlier.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28481 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Tigergraph Enterprise 3.7.0. There is unsecured write access to SSH authorized keys file. Any code running as the tigergraph user is able to add their SSH public key into the authorised keys file. This allows an attacker to obtain password-less SSH key access by using their own SSH key.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32748 ‼
📖 Read
via "National Vulnerability Database".
The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39292 ‼
📖 Read
via "National Vulnerability Database".
A SQL Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to access sensitive information and execute arbitrary database and management operations.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40360 ‼
📖 Read
via "National Vulnerability Database".
QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-28483 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Tigergraph Enterprise 3.7.0. The GSQL query language provides users with the ability to write data to files on a remote TigerGraph server. The locations that a query is allowed to write to are configurable via the GSQL.FileOutputPolicy configuration setting. GSQL queries that contain UDFs can bypass this configuration setting and, as a consequence, can write to any file location to which the administrative user has access.📖 Read
via "National Vulnerability Database".