🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-32636 ‼

A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.

📖 Read

via "National Vulnerability Database".

117 views22:24

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-37755 ‼

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS).

📖 Read

via "National Vulnerability Database".

149 views22:24

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-38912 ‼

SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter.

📖 Read

via "National Vulnerability Database".

145 views22:24

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-37739 ‼

i-doit Pro v25 and below was discovered to be vulnerable to path traversal.

📖 Read

via "National Vulnerability Database".

128 views22:24

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-41156 ‼

A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the save to new folder named field while creating a new filter.

📖 Read

via "National Vulnerability Database".

138 views22:24

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-41160 ‼

A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the key name field while adding an authorized key.

📖 Read

via "National Vulnerability Database".

155 views22:24

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-41588 ‼

A cross-site scripting (XSS) vulnerability in Time to SLA plugin v10.13.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the durationFormat parameter.

📖 Read

via "National Vulnerability Database".

149 views22:24

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-42362 ‼

An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands and obtain sensitive information via uploading a crafted file.

📖 Read

via "National Vulnerability Database".

141 views22:24

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-4563 ‼

** REJECT ** This was assigned as a duplicate of CVE-2023-4244.

📖 Read

via "National Vulnerability Database".

144 views22:25

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-25588 ‼

A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service.

📖 Read

via "National Vulnerability Database".

140 views22:25

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-25585 ‼

A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service.

📖 Read

via "National Vulnerability Database".

142 views22:25

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-37756 ‼

I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack.

📖 Read

via "National Vulnerability Database".

157 views22:25

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-25584 ‼

An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.

📖 Read

via "National Vulnerability Database".

153 views22:25

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-29499 ‼

A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.

📖 Read

via "National Vulnerability Database".

187 views22:25

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-25586 ‼

A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.

📖 Read

via "National Vulnerability Database".

207 views22:25

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-41159 ‼

A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML by editing the forward file manually.

📖 Read

via "National Vulnerability Database".

193 views22:25

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-32665 ‼

A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

📖 Read

via "National Vulnerability Database".

190 views22:25

🛡 Cybersecurity & Privacy 🛡 - News

🕴 Microsoft Teams Hacks Are Back, As Storm-0324 Embraces TeamsPhisher 🕴

Collaboration apps are a boost to business productivity, but also a uniquely attractive target for cyberattackers.

📖 Read

via "Dark Reading".

Dark Reading

Microsoft Teams Hacks Are Back, as Storm-0324 Embraces TeamsPhisher

Collaboration apps are a boost to business productivity, but also a uniquely attractive target for cyberattackers.

234 views22:46

🛡 Cybersecurity & Privacy 🛡 - News

🕴 Why Identity Management Is the Key to Stopping APT Cyberattacks 🕴

Dark Reading News Desk: CrowdStrike's Adam Meyers talks China, Iran, Russia, and more in this expert dive into the current APT threat actor landscape.

📖 Read

via "Dark Reading".

Dark Reading

Why Identity Management Is the Key to Stopping APT Cyberattacks

Dark Reading News Desk: CrowdStrike's Adam Meyers talks China, Iran, Russia, and more in this expert dive into the current APT threat actor landscape.

293 views23:16

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-38891 ‼

SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRun.php.

📖 Read

via "National Vulnerability Database".

268 views00:24

🛡 Cybersecurity & Privacy 🛡 - News

‼ CVE-2023-40869 ‼

Cross Site Scripting vulnerability in mooSocial mooSocial Software 3.1.6 and 3.1.7 allows a remote attacker to execute arbitrary code via a crafted script to the edit_menu, copuon, and group_categorias functions.

📖 Read

via "National Vulnerability Database".

270 views00:24

About

Blog

Apps

Platform