‼ CVE-2022-3742 ‼
📖 Read
via "National Vulnerability Database".
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to execute arbitrary code due to improper buffer validation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40177 ‼
📖 Read
via "National Vulnerability Database".
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is present since version 4.3M2 when AppWithinMinutes Application added support for the Content field, allowing any wiki page (including the user profile page) to use its content as an AWM Content field, which has a custom displayer that executes the content with the rights of the ``AppWithinMinutes.Content`` author, rather than the rights of the content author. The vulnerability has been fixed in XWiki 14.10.5 and 15.1RC1. The fix is in the content of the AppWithinMinutes.Content page that defines the custom displayer. By using the ``display`` script service to render the content we make sure that the proper author is used for access rights checks.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3745 ‼
📖 Read
via "National Vulnerability Database".
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to view incoming and returned data from SMI.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3743 ‼
📖 Read
via "National Vulnerability Database".
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under certain conditions the ability to enumerate Embedded Controller (EC) commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3746 ‼
📖 Read
via "National Vulnerability Database".
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to cause some peripherals to work abnormally due to an exposed Embedded Controller (EC) interface.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40178 ‼
📖 Read
via "National Vulnerability Database".
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an expired LogoutRequest. In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large scale. This issue was patched in version 4.0.5.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40185 ‼
📖 Read
via "National Vulnerability Database".
shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This bug has been patched in version 1.7.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40035 ‼
📖 Read
via "National Vulnerability Database".
Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40176 ‼
📖 Read
via "National Vulnerability Database".
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. Even though the time zone is selected from a drop down (no free text value) it can still be set from JavaScript (using the browser developer tools) or by calling the save URL on the user profile with the right query string. Once the time zone is set it is displayed without escaping which means the payload gets executed for any user that visits the malicious user profile, allowing the attacker to steal information and even gain more access rights (escalation to programming rights). This issue is present since version 4.1M2 when the time zone user preference was introduced. The issue has been fixed in XWiki 14.10.5 and 15.1RC1.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3453 ‼
📖 Read
via "National Vulnerability Database".
ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41028 ‼
📖 Read
via "National Vulnerability Database".
A stack-based buffer overflow exists in Juplink RX4-1500, a WiFi router, in versions 1.0.2 through 1.0.5. An authenticated attacker can exploit this vulnerability to achieve code execution as root.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32202 ‼
📖 Read
via "National Vulnerability Database".
Walchem Intuition 9 firmware versions prior to v4.21 are vulnerable to improper authentication. Login credentials are stored in a format that could allow an attacker to use them as-is to login and gain access to the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36317 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in sourcecodester Student Study Center Desk Management System 1.0 allows attackers to run arbitrary code via crafted GET request to web application URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38422 ‼
📖 Read
via "National Vulnerability Database".
Walchem Intuition 9 firmware versions prior to v4.21 are missing authentication for some of the API routes of the management web server. This could allow an attacker to download and export sensitive data.📖 Read
via "National Vulnerability Database".
âš Using WinRAR? Be sure to patch against these code execution bugs… âš
📖 Read
via "Naked Security".
Imagine if you clicked on a harmless-looking image, but an unknown application fired up instead...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🕴 Prelude Security Tackles Continuous Security Testing in Containers 🕴
📖 Read
via "Dark Reading".
Probes are tiny processes which run inside containers and scan applications for vulnerabilities.📖 Read
via "Dark Reading".
Dark Reading
Prelude Security Tackles Continuous Security Testing in Containers
Probes are tiny processes that run inside containers and scan applications for vulnerabilities.
‼ CVE-2023-40573 ‼
📖 Read
via "National Vulnerability Database".
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document doesn't modify the content author. Together with a CSRF vulnerability in the job scheduler, this can be exploited for remote code execution by an attacker with edit right on the wiki. If the attack is successful, an error log entry with "Job content executed" will be produced. This vulnerability has been patched in XWiki 14.10.9 and 15.4RC1.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32559 ‼
📖 Read
via "National Vulnerability Database".
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40572 ‼
📖 Read
via "National Vulnerability Database".
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.📖 Read
via "National Vulnerability Database".
📢 Salt Security lifts lid on new STEP partner program 📢
📖 Read
via "ITPro".
Initiative's inaugural partners include Bright Security, Invicti, StackHawk, and Contrast Security 📖 Read
via "ITPro".
channelpro
Salt Security lifts lid on new STEP partner program
Initiative's inaugural partners include Bright Security, Invicti, StackHawk, and Contrast Security
🕴 eSentire Labs Open Sources Project to Monitor LLMs 🕴
📖 Read
via "Dark Reading".
The eSentire LLM Gateway provides monitoring and governance of ChatGPT and other Large Language Models being used in the organization.📖 Read
via "Dark Reading".
Dark Reading
eSentire Labs Open Sources Project to Monitor LLMs
The eSentire LLM Gateway provides monitoring and governance of ChatGPT and other large language models being used in the organization.