‼ CVE-2022-24989 ‼
📖 Read
via "National Vulnerability Database".
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36674 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4437 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app/ajax/search_sell_paymen_report.php. The manipulation of the argument customer leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-237558 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4439 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in SourceCodester Card Holder Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Minus Value Handler. The manipulation leads to improper validation of specified quantity in input. The attack may be launched remotely. The identifier of this vulnerability is VDB-237560.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4436 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0. This issue affects some unknown processing of the file app/action/edit_update.php. The manipulation of the argument user_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237557 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4440 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been classified as critical. This affects an unknown part of the file appointment.php. The manipulation of the argument sheduledate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237561 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4438 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file app/ajax/search_sales_report.php. The manipulation of the argument customer leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237559.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-39939 ‼
📖 Read
via "National Vulnerability Database".
SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute arbitrary queries against the database and obtain or alter the information in it.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39543 ‼
📖 Read
via "National Vulnerability Database".
Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46751 ‼
📖 Read
via "National Vulnerability Database".
Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2.When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used.This can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways.Starting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed.Users of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about "JAXP Properties for External Access restrictions" inside Oracle's "Java API for XML Processing (JAXP) Security Guide".📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40068 ‼
📖 Read
via "National Vulnerability Database".
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3481 ‼
📖 Read
via "National Vulnerability Database".
Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension. 📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4454 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4455 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4453 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.📖 Read
via "National Vulnerability Database".
🕴 DEF CON's AI Village Pits Hackers Against LLMs to Find Flaws 🕴
📖 Read
via "Dark Reading".
Touted as the largest red teaming exercise against LLMs in history, the AI Village attracted more than 2,000 hackers and throngs of media.📖 Read
via "Dark Reading".
Dark Reading
DEF CON's AI Village Pits Hackers Against LLMs to Find Flaws
Touted as the largest red teaming exercise against LLMs in history, the AI Village attracted more than 2,000 hackers and throngs of media.
🕴 Generative AI Is Scraping Your Data. So, Now What? 🕴
📖 Read
via "Dark Reading".
AI innovation is moving faster than our laws and regulations, making it hard to decide whether Web or content scraping activity is good or bad, and what (if anything) you should do about it.📖 Read
via "Dark Reading".
Dark Reading
Generative AI Is Scraping Your Data. So, Now What?
AI innovation is moving faster than our laws and regulations, making it hard to decide whether Web or content scraping activity is good or bad, and what (if anything) you should do about it.
‼ CVE-2020-28715 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in kdmserver service in LeEco LeTV X43 version V2401RCN02C080080B04121S, allows attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS).📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40735 ‼
📖 Read
via "National Vulnerability Database".
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BUTTERFLY BUTTON PROJECT - BUTTERFLY BUTTON (Architecture) allows loss of plausible deniability, confidentiality.This issue affects BUTTERFLY BUTTON: As of 2023-08-21.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38899 ‼
📖 Read
via "National Vulnerability Database".
SQL injection vulnerability in berkaygediz O_Blog v.1.0 allows a local attacker to escalate privileges via the secure_file_priv component.📖 Read
via "National Vulnerability Database".
⚠ “Snakes in airplane mode” – what if your phone says it’s offline but isn’t? ⚠
📖 Read
via "Naked Security".
WYSIWYG is short for "what you see is what you get". Except when it isn't...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News