🦿 UK’s NCSC Warns Against Cybersecurity Attacks on AI 🦿
📖 Read
via "Tech Republic".
The National Cyber Security Centre provides details on prompt injection and data poisoning attacks so organizations using machine-learning models can mitigate the risks.📖 Read
via "Tech Republic".
TechRepublic
UK’s NCSC Warns Against Cybersecurity Attacks on AI
U.K.’s National Cyber Security Centre publication on AI details attacks that might target organizations implementing or developing ML models.
🕴 MSSQL Databases Under Fire From FreeWorld Ransomware 🕴
📖 Read
via "Dark Reading".
The sophisticated attacks, tracked as DB#JAMMER, run shell commands to impair defenses and deploy tools to establish persistence on the host.📖 Read
via "Dark Reading".
Dark Reading
MSSQL Databases Under Fire From FreeWorld Ransomware
The sophisticated attacks, tracked as DB#JAMMER, run shell commands to impair defenses and deploy tools to establish persistence on the host.
🕴 US Government Denies Blocking Sales of AI Chips to Middle East 🕴
📖 Read
via "Dark Reading".
Nvidia and AMD do face expanded export rules for their A100 and H100 artificial intelligence (AI) chips in the Middle East, but it's not yet clear why.📖 Read
via "Dark Reading".
Dark Reading
US Government Denies Blocking Sales of AI Chips to Middle East
Nvidia and AMD do face expanded export rules for their A100 and H100 artificial intelligence (AI) chips in the Middle East, but it's not yet clear why.
🕴 Inaugural Pwn2Own Automotive Contest Dangles $1M for Car Hackers 🕴
📖 Read
via "Dark Reading".
The competition encourages automotive research and allows for contestants to take part in person or remotely.📖 Read
via "Dark Reading".
Dark Reading
Inaugural Pwn2Own Automotive Contest Dangles $1M for Car Hackers
The competition encourages automotive research and allows for contestants to take part in person or remotely.
‼ CVE-2023-4709 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as problematic has been found in TOTVS RM 12.1. Affected is an unknown function of the file Login.aspx of the component Portal. The manipulation of the argument VIEWSTATE leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-238572. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41633 ‼
📖 Read
via "National Vulnerability Database".
Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4707 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been declared as problematic. This vulnerability affects unknown code of the file /collection/all. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. VDB-238570 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39714 ‼
📖 Read
via "National Vulnerability Database".
Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add New Member section.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1523 ‼
📖 Read
via "National Vulnerability Database".
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41051 ‼
📖 Read
via "National Vulnerability Database".
In a typical Virtual Machine Monitor (VMM) there are several components, such as boot loader, virtual device drivers, virtio backend drivers and vhost drivers, that need to access the VM physical memory. The vm-memory rust crate provides a set of traits to decouple VM memory consumers from VM memory providers. An issue was discovered in the default implementations of the `VolatileMemory::{get_atomic_ref, aligned_as_ref, aligned_as_mut, get_ref, get_array_ref}` trait functions, which allows out-of-bounds memory access if the `VolatileMemory::get_slice` function returns a `VolatileSlice` whose length is less than the function’s `count` argument. No implementations of `get_slice` provided in `vm_memory` are affected. Users of custom `VolatileMemory` implementations may be impacted if the custom implementation does not adhere to `get_slice`'s documentation. The issue started in version 0.1.0 but was fixed in version 0.12.2 by inserting a check that verifies that the `VolatileSlice` returned by `get_slice` is of the correct length. Users are advised to upgrade. There are no known workarounds for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4708 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /collection/all of the component GET Parameter Handler. The manipulation of the argument tag leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-238571. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
🕴 AI for Good: Voxel AI Tech Increases Funding to $30M With Strategic Funding Round 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
AI for Good: Voxel AI Tech Increases Funding to $30M With Strategic Funding Round
San Francisco, California - August 30, 2023; Every year over 340m workers suffer a workplace injury: slips and falls, strains and sprains, vehicle collisions and crashes. Voxel, an AI startup using computer vision to transform safety and operations in the…
🕴 ReasonLabs Summer 2023 Trends Report Reveals Top Consumer Security Threats 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
ReasonLabs Summer 2023 Trends Report Reveals Top Consumer Security Threats
NEW YORK, Aug. 31, 2023 /PRNewswire/ -- ReasonLabs, the cybersecurity pioneer equipping home users with the same level of cyber protection used by Fortune 500 companies, today released its Summer 2023 Consumer Cybersecurity Trends Report. The report, which…
🕴 Lacework Expands Partnership With Google Cloud to Deliver Enterprise Flexibility in the Cloud 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
Lacework Expands Partnership With Google Cloud to Deliver Enterprise Flexibility in the Cloud
MOUNTAIN VIEW, Calif., Aug. 29, 2023 /PRNewswire/ -- Lacework, the data-driven cloud security company, today announced an expansion of its partnership with Google Cloud. Several new features will allow joint customers to innovate even faster in Google Cloud…
‼ CVE-2023-4713 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function addComment of the file ?r=weibo/comment/addcomment. The manipulation of the argument touid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238576. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4714 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. The identifier VDB-238577 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4711 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819. Affected by this issue is some unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to os command injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-238574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41049 ‼
📖 Read
via "National Vulnerability Database".
@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the `init` function allows arbitrary javascript to be executed using the `javascript:` prefix. This vulnerability has been patched on version `0.1.0`. Users are advised to upgrade. Users unable to upgrade should limit untrusted user input to the `init` function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4710 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as problematic was found in TOTVS RM 12.1. Affected by this vulnerability is an unknown functionality of the component Portal. The manipulation of the argument d leads to cross site scripting. The attack can be launched remotely. The identifier VDB-238573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3297 ‼
📖 Read
via "National Vulnerability Database".
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41046 ‼
📖 Read
via "National Vulnerability Database".
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the former, the syntax of the document needs to be set the `xwiki/1.0` (this syntax doesn't need to be installed). In both cases, when adding the property to an object, the Velocity code is executed regardless of the rights of the author of the property (edit right is still required, though). In both cases, the code is executed with the correct context author so no privileged APIs can be accessed. However, Velocity still grants access to otherwise inaccessible data and APIs that could allow further privilege escalation. At least for "VelocityCode", this behavior is most likely very old but only since XWiki 7.2, script right is a separate right, before that version all users were allowed to execute Velocity and thus this was expected and not a security issue. This has been patched in XWiki 14.10.10 and 15.4 RC1. Users are advised to upgrade. There are no known workarounds.📖 Read
via "National Vulnerability Database".