‼ CVE-2023-4236 ‼
📖 Read
via "National Vulnerability Database".
A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load.This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0829 ‼
📖 Read
via "National Vulnerability Database".
Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious subscription.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-45448 ‼
📖 Read
via "National Vulnerability Database".
M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource /m4pdf/pdf.php uses templates to dynamically create documents. In the case that the template does not exist, the application will return a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5042 ‼
📖 Read
via "National Vulnerability Database".
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40713.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-43477 ‼
📖 Read
via "National Vulnerability Database".
The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanitized before being used in a system call, which could allow an authenticated attacker to achieve command injection as root on the device. 📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3341 ‼
📖 Read
via "National Vulnerability Database".
The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary.This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.📖 Read
via "National Vulnerability Database".
🕴 International Criminal Court Suffers Cyberattack 🕴
📖 Read
via "Dark Reading".
The ICC did not reveal details on the cyber breach. 📖 Read
via "Dark Reading".
Dark Reading
International Criminal Court Suffers Cyberattack
The ICC did not reveal details on the cyber breach.
‼ CVE-2023-43496 ‼
📖 Read
via "National Vulnerability Database".
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2508 ‼
📖 Read
via "National Vulnerability Database".
The `PaperCutNG Mobility Print` version 1.0.3512 application allows anunauthenticated attacker to perform a CSRF attack on an instanceadministrator to configure the clients host (in the "configure printerdiscovery" section). This is possible because the application has noprotections against CSRF attacks, like Anti-CSRF tokens, header originvalidation, samesite cookies, etc.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5074 ‼
📖 Read
via "National Vulnerability Database".
Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43501 ‼
📖 Read
via "National Vulnerability Database".
A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43494 ‼
📖 Read
via "National Vulnerability Database".
Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43498 ‼
📖 Read
via "National Vulnerability Database".
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43502 ‼
📖 Read
via "National Vulnerability Database".
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42660 ‼
📖 Read
via "National Vulnerability Database".
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2262 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices. If exploited, a threat actor could potentially leverage this vulnerability to perform a remote code execution. To exploit this vulnerability, a threat actor would have to send a maliciously crafted CIP request to device.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40043 ‼
📖 Read
via "National Vulnerability Database".
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain unauthorized access to the MOVEit Transfer database. A MOVEit system administrator could submit a crafted payload to the MOVEit Transfer web interface which could result in modification and disclosure of MOVEit database content.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42656 ‼
📖 Read
via "National Vulnerability Database".
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer's web interface. An attacker could craft a malicious payload targeting MOVEit Transfer users during the package composition procedure. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43495 ‼
📖 Read
via "National Vulnerability Database".
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43500 ‼
📖 Read
via "National Vulnerability Database".
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43499 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.📖 Read
via "National Vulnerability Database".