🕴 Payment Card-Skimming Campaign Now Targeting Websites in North America 🕴
📖 Read
via "Dark Reading".
"Silent Skimmer" is a technically complex campaign that has successfully targeted online businesses in the Asia Pacific region for over a year.📖 Read
via "Dark Reading".
Dark Reading
Payment Card-Skimming Campaign Now Targeting Websites in North America
"Silent Skimmer" is a technically complex campaign that has successfully targeted online businesses in the Asia Pacific region for over a year.
‼ CVE-2023-39039 ‼
📖 Read
via "National Vulnerability Database".
An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33831 ‼
📖 Read
via "National Vulnerability Database".
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41084 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPPORTED WHEN ASSIGNED ** Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-41965 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPPORTED WHEN ASSIGNED ** Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38255 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPPORTED WHEN ASSIGNED ** A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new device configuration that could affect the intended function of the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39043 ‼
📖 Read
via "National Vulnerability Database".
An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42441 ‼
📖 Read
via "National Vulnerability Database".
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40221 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPPORTED WHEN ASSIGNED ** The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section (MAIL SERVER) where the information is displayed. Injection can be done on parameter MAIL_RCV. When a legitimate user attempts to review NOTIFICATION/MAIL SERVER, the injected code will be executed.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38582 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPPORTED WHEN ASSIGNED ** Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAIL_RCV. When a legitimate user attempts to access to the vulnerable page of the web application, the XSS payload will be executed.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42443 ‼
📖 Read
via "National Vulnerability Database".
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and `create_copy_of` can be corrupted. For `raw_call`, the argument buffer of the call can be corrupted, leading to incorrect `calldata` in the sub-context. For `create_from_blueprint` and `create_copy_of`, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode.Each builtin has conditions that must be fulfilled for the corruption to happen. For `raw_call`, the `data` argument of the builtin must be `msg.data` and the `value` or `gas` passed to the builtin must be some complex expression that results in writing to the memory. For `create_copy_of`, the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. For `create_from_blueprint`, either no constructor parameters should be passed to the builtin or `raw_args` should be set to True, and the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory.As of time of publication, no patched version exists. The issue is still being investigated, and there might be other cases where the corruption might happen. When the builtin is being called from an `internal` function `F`, the issue is not present provided that the function calling `F` wrote to memory before calling `F`. As a workaround, the complex expressions that are being passed as kwargs to the builtin should be cached in memory prior to the call to the builtin.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39040 ‼
📖 Read
via "National Vulnerability Database".
An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39058 ‼
📖 Read
via "National Vulnerability Database".
An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39446 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPPORTED WHEN ASSIGNED ** Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39452 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPPORTED WHEN ASSIGNED ** The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application.📖 Read
via "National Vulnerability Database".
👍1
🦿 White Hat Hackers Discover Microsoft Leak of 38TB of Internal Data Via Azure Storage 🦿
📖 Read
via "Tech Republic".
The Microsoft leak, which stemmed from AI researchers sharing open-source training data on GitHub, has been mitigated.📖 Read
via "Tech Republic".
TechRepublic
White Hat Hackers Discover Microsoft Leak of 38TB of Internal Data Via Azure Storage
The Microsoft leak, which stemmed from AI researchers sharing open-source training data on GitHub, has been mitigated.
🕴 Niagara Networks and Scope Middle East Announce Strategic VAD Partnership 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
Niagara Networks and Scope Middle East Announce Strategic VAD Partnership
FREMONT, Calif., Sept. 18, 2023 /PRNewswire/ -- Niagara Networks™, a Silicon Valley-based company that pioneers the award-winning Open Visibility Platform™, announced today a new partnership with SCOPE Middle East®, a Value-Added Distribution leader in the…
‼ CVE-2023-42454 ‼
📖 Read
via "National Vulnerability Database".
SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection string specified in the `sqlpage/sqlpage.json` configuration file (not in an environment variable), with the web_root is the current working directory (the default), and with their database exposed publicly, is vulnerable to an attacker retrieving database connection information from SQLPage and using it to connect to their database directly. Version 0.11.0 fixes this issue. Some workarounds are available. Using an environment variable instead of the configuration file to specify the database connection string prevents exposing it on vulnerable versions. Using a different web root (that is not a parent of the SQLPage configuration directory) fixes the issue. One should also avoid exposing one's database publicly.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37611 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file to the neos/management/media component.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39056 ‼
📖 Read
via "National Vulnerability Database".
An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41443 ‼
📖 Read
via "National Vulnerability Database".
SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/list.📖 Read
via "National Vulnerability Database".