‼ CVE-2023-4559 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, has been found in Bettershop LaikeTui. Affected by this issue is some unknown functionality of the file index.php?module=api&action=user&m=upload of the component POST Request Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-238160.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33852 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium 11.4 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 257614.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2022-43904 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium 11.3 and 11.4 could disclose sensitive information to an attacker due to improper restriction of excessive authentication attempts. IBM X-Force ID: 240895.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38024 ‼
📖 Read
via "National Vulnerability Database".
SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23473 ‼
📖 Read
via "National Vulnerability Database".
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 245400.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24959 ‼
📖 Read
via "National Vulnerability Database".
IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration. IBM X-Force ID: 246332.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38026 ‼
📖 Read
via "National Vulnerability Database".
SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22877 ‼
📖 Read
via "National Vulnerability Database".
IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 244368.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26270 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to execute arbitrary code on the system, caused by an angular template injection flaw. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 248119.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4561 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26271 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 248126.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38027 ‼
📖 Read
via "National Vulnerability Database".
SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to perform arbitrary system commands or disrupt service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38025 ‼
📖 Read
via "National Vulnerability Database".
SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to arbitrary system commands or disrupt service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26272 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 248133.📖 Read
via "National Vulnerability Database".
‼ CVE-2016-15035 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Doc2k RE-Chat 1.0. It has been classified as problematic. This affects an unknown part of the file js_on_radio-emergency.de_/re_chat.js. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named bd17d497ddd3bab4ef9c6831c747c37cc016c570. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-238155.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4560 ‼
📖 Read
via "National Vulnerability Database".
Improper Authorization of Index Containing Sensitive Information in GitHub repository omeka/omeka-s prior to 4.0.4.📖 Read
via "National Vulnerability Database".
🕴 Better SaaS Security Goes Beyond Procurement 🕴
📖 Read
via "Dark Reading".
The impulse to achieve strong SaaS security adherence through strict gatekeeping during procurement fails to reduce the risk that matters most.📖 Read
via "Dark Reading".
Dark Reading
Better SaaS Security Goes Beyond Procurement
The impulse to achieve strong SaaS security adherence through strict gatekeeping during procurement fails to reduce the risk that matters most.
🕴 Malware Unleashed: Public Sector Hit in Sudden Surge, Reveals New Research 🕴
📖 Read
via "Dark Reading".
Report unmasks recent cybersecurity challenges for governments, healthcare, financial services, and vital infrastructure.📖 Read
via "Dark Reading".
Dark Reading
Malware Unleashed: Public Sector Hit in Sudden Surge, Reveals New Research
Report unmasks recent cybersecurity challenges for governments, healthcare, financial services, and vital infrastructure.
‼ CVE-2023-38030 ‼
📖 Read
via "National Vulnerability Database".
Saho’s attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated remote attacker can execute system commands in partial website URLs to read sensitive device information without permissions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40195 ‼
📖 Read
via "National Vulnerability Database".
Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider.When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation explicitly, so it is possible that administrators provided authorizations to configure Spark hooks without taking this into account. We recommend administrators to review their configurations to make sure the authorization to configure Spark hooks is only provided to fully trusted users.To view the warning in the docs please visit https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html📖 Read
via "National Vulnerability Database".