🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
‼ CVE-2023-36361 ‼

Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter.

📖 Read

via "National Vulnerability Database".
‼ CVE-2023-32271 ‼

An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to a disclosure of sensitive information. An attacker can send a sequence of requests to trigger this vulnerability.

📖 Read

via "National Vulnerability Database".
‼ CVE-2023-34353 ‼

An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted network sniffing can lead to decryption of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.

📖 Read

via "National Vulnerability Database".
‼ CVE-2023-3374 ‼

Incomplete List of Disallowed Inputs vulnerability in Bookreen allows Privilege Escalation.This issue affects Bookreen: before 3.0.0.

📖 Read

via "National Vulnerability Database".
‼ CVE-2023-41012 ‼

An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the authentication mechanism.

📖 Read

via "National Vulnerability Database".
‼ CVE-2023-4778 ‼

Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.

📖 Read

via "National Vulnerability Database".
‼ CVE-2023-3375 ‼

Unrestricted Upload of File with Dangerous Type vulnerability in Bookreen allows OS Command Injection.This issue affects Bookreen: before 3.0.0.

📖 Read

via "National Vulnerability Database".
‼ CVE-2023-31242 ‼

An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series of network requests can lead to arbitrary authentication. An attacker can send a sequence of requests to trigger this vulnerability.

📖 Read

via "National Vulnerability Database".
‼ CVE-2023-34994 ‼

An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to creation of an arbitrary directory. An attacker can send a sequence of requests to trigger this vulnerability.

📖 Read

via "National Vulnerability Database".
‼ CVE-2023-34317 ‼

An improper input validation vulnerability exists in the OAS Engine User Creation functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to unexpected data in the configuration. An attacker can send a sequence of requests to trigger this vulnerability.

📖 Read

via "National Vulnerability Database".
🕴 Russia Undertakes Disinformation Campaign Across Africa 🕴

Following coups in some African nations, Russia is exploiting the instability with the manipulation of media channels to stoke anti-French sentiment, among other things.

📖 Read

via "Dark Reading".
🕴 Hackers Target High-Privileged Okta Accounts via Help Desk 🕴

Threat actors convince employees to reset MFA for Super Admin accounts in the IAM service to leverage compromised accounts, impersonating users and moving laterally within an organization.

📖 Read

via "Dark Reading".
🕴 Data Initiatives Force Closer Partnership Between CISOs, CDOs 🕴

Though security leaders and chief data officers both care about data management, their different missions have created a tension that needs addressing.

📖 Read

via "Dark Reading".
🕴 Peiter 'Mudge' Zatko Lands Role as CISA Senior Technical Adviser 🕴

The former hacker and Twitter security executive will use his role to help fulfill the Biden administration's plans for the National Cybersecurity Strategy.

📖 Read

via "Dark Reading".
🕴 GhostSec Leaks Source Code of Alleged Iranian Surveillance Tool 🕴

GhostSec has made the source code for what it calls a powerful surveillance tool openly available in a 26GB file, but FANAP denies its legitimacy.

📖 Read

via "Dark Reading".
‼ CVE-2020-35593 ‼

BMC PATROL Agent through 20.08.00 allows local privilege escalation via vectors involving pconfig +RESTART -host.

📖 Read

via "National Vulnerability Database".
‼ CVE-2015-2201 ‼

Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.

📖 Read

via "National Vulnerability Database".
‼ CVE-2023-35068 ‼

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BMA Personnel Tracking System allows SQL Injection.This issue affects Personnel Tracking System: before 20230904.

📖 Read

via "National Vulnerability Database".
‼ CVE-2017-9453 ‼

BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass.

📖 Read

via "National Vulnerability Database".
‼ CVE-2015-2202 ‼

Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-40546 ‼

Tenda AC6 US_AC6V4.0RTL_V02.03.01.26_cn.bin allows attackers (who have the administrator password) to cause a denial of service (device crash) via a long string in the wifiPwd_5G parameter to /goform/setWifi.

📖 Read

via "National Vulnerability Database".