‼ CVE-2023-4501 ‼
📖 Read
via "National Vulnerability Database".
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user.Mitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon.Administrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.📖 Read
via "National Vulnerability Database".
🕴 China's Winnti APT Compromises National Grid in Asia for 6 Months 🕴
📖 Read
via "Dark Reading".
Attacks against critical infrastructure are becoming more commonplace and, if a recent PRC-sponsored attack is anything to go by, easier to pull off.📖 Read
via "Dark Reading".
Dark Reading
China's Winnti APT Compromises National Grid in Asia for 6 Months
Attacks against critical infrastructure are becoming more commonplace and, if a recent PRC-sponsored attack is anything to go by, easier to pull off.
‼ CVE-2023-21523 ‼
📖 Read
via "National Vulnerability Database".
A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4918 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are able to read users attributes, allowing a malicious user with minimal access to retrieve the users passwords in clear text, jeopardizing their environment.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4903 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4907 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4921 ‼
📖 Read
via "National Vulnerability Database".
A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue().We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41331 ‼
📖 Read
via "National Vulnerability Database".
SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefullycrafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framework, a blacklist is used to filter out dangerous classes encountered during the deserialization process. However, the blacklist is not comprehensive, and an actor can exploit certain native JDK classes and common third-party packages to construct gadget chains capable of achieving JNDI injection or system command execution attacks. Version 5.11.0 contains a fix for this issue. As a workaround, users can add `-Drpc_serialize_blacklist_override=javax.sound.sampled.AudioFileFormat` to the blacklist.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4904 ‼
📖 Read
via "National Vulnerability Database".
Insufficient policy enforcement in Downloads in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Enterprise policy restrictions via a crafted download. (Chromium security severity: Medium)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4908 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39208 ‼
📖 Read
via "National Vulnerability Database".
Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of service via network access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4909 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3712 ‼
📖 Read
via "National Vulnerability Database".
Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3710 ‼
📖 Read
via "National Vulnerability Database".
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41885 ‼
📖 Read
via "National Vulnerability Database".
Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not also enforce strong passwords, these lists of valid accounts are likely to be used in a password spray attack with the outcome being attempted takeover of user accounts on the platform. The impact of this vulnerability is minor as it requires chaining with other attack vectors in order to gain more then simply a list of valid users on the underlying platform. The likelihood of this vulnerability is possible as it requires minimal skills to pull off, especially given the underlying login functionality for Piccolo based sites is open source. This issue has been patched in version 0.121.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39215 ‼
📖 Read
via "National Vulnerability Database".
Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4905 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3711 ‼
📖 Read
via "National Vulnerability Database".
Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4900 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a permission prompt via a crafted HTML page. (Chromium security severity: Medium)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39201 ‼
📖 Read
via "National Vulnerability Database".
Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4902 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)📖 Read
via "National Vulnerability Database".