‼ CVE-2023-40970 ‼
📖 Read
via "National Vulnerability Database".
Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25488 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Duc Bui Quang WP Default Feature Image plugin <=Â 1.0.1.1 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24412 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Image Social Feed plugin <=Â 1.7.6 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4704 ‼
📖 Read
via "National Vulnerability Database".
External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4343 ‼
📖 Read
via "National Vulnerability Database".
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which a project member can leak credentials stored in site profile.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39685 ‼
📖 Read
via "National Vulnerability Database".
An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37827 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the executionBlockName parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22305 ‼
📖 Read
via "National Vulnerability Database".
An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.x; FortiSandbox 4.0.x, 3.2.x and 3.1.x may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some external peers.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37986 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange YourMembership Single Sign On – YM SSO Login plugin <= 1.1.3 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37828 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tasktyp parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37893 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chop-Chop Coming Soon Chop Chop plugin <=Â 2.2.4 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-34011 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ShopConstruct plugin <=Â 1.1.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37994 ‼
📖 Read
via "National Vulnerability Database".
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Artem Abramovich Art Decoration Shortcode plugin <=Â 1.5.6 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37830 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39703 ‼
📖 Read
via "National Vulnerability Database".
A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted Markdown file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37826 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fieldname parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37997 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dharmesh Patel Post List With Featured Image plugin <=Â 1.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37829 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the notification.message parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39710 ‼
📖 Read
via "National Vulnerability Database".
Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add Customer section.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23763 ‼
📖 Read
via "National Vulnerability Database".
An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upstream repository after its visibility was changed to private. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.10.0 and was fixed in versions 3.9.4, 3.8.9, 3.7.16 and 3.6.18. This vulnerability was reported via the GitHub Bug Bounty program.📖 Read
via "National Vulnerability Database".
♟️ Why is .US Being Used to Phish So Many of Us? ♟️
📖 Read
via "Krebs on Security".
Domain names ending in “.US” — the top-level domain for the United States — are among the most prevalent in phishing scams, new research shows. This is noteworthy because .US is overseen by the U.S. government, which is frequently the target of phishing domains ending in .US. Also, .US domains are only supposed to be available to U.S. citizens and to those who can demonstrate that they have a physical presence in the United States.📖 Read
via "Krebs on Security".
Krebs on Security
Why is .US Being Used to Phish So Many of Us?
Domain names ending in “.US” — the top-level domain for the United States — are among the most prevalent in phishing scams, new research shows. This is noteworthy because .US is overseen by the U.S. government, which is frequently the…