‼ CVE-2023-42660 ‼
📖 Read
via "National Vulnerability Database".
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2262 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices. If exploited, a threat actor could potentially leverage this vulnerability to perform a remote code execution. To exploit this vulnerability, a threat actor would have to send a maliciously crafted CIP request to device.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40043 ‼
📖 Read
via "National Vulnerability Database".
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain unauthorized access to the MOVEit Transfer database. A MOVEit system administrator could submit a crafted payload to the MOVEit Transfer web interface which could result in modification and disclosure of MOVEit database content.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42656 ‼
📖 Read
via "National Vulnerability Database".
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer's web interface. An attacker could craft a malicious payload targeting MOVEit Transfer users during the package composition procedure. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43495 ‼
📖 Read
via "National Vulnerability Database".
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43500 ‼
📖 Read
via "National Vulnerability Database".
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43499 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43497 ‼
📖 Read
via "National Vulnerability Database".
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.📖 Read
via "National Vulnerability Database".
🕴 OneLayer Expands Its Private Cellular Network Security Solutions to Operations and Asset Management 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
OneLayer Expands Its Private Cellular Network Security Solutions to Operations and Asset Management
BOSTON, Sept. 20, 2023 /PRNewswire/ -- OneLayer, a leader in securing private LTE/5G networks for enterprises, announced today the expansion of its private cellular network security solutions to encompass the areas of operations and asset management, leveraging…
🕴 Dig Security Enhances DSPM Platform to Secure Enterprise Data in On-Prem, File-Share Environments 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
Dig Security Enhances DSPM Platform to Secure Enterprise Data in On-Prem, File-Share Environments
TEL AVIV, Israel, September 20, 2023 — Dig, the cloud data security leader, today announced the expansion of the Dig Data Security Platform to protect data anywhere enterprises store sensitive information, including public cloud, software as a service (SaaS)…
🕴 FBI, CISA Issue Joint Warning on 'Snatch' Ransomware-as-a-Service 🕴
📖 Read
via "Dark Reading".
The group's use of malware that forces Windows computers to reboot into Safe Mode before encrypting files is noteworthy, advisory says.📖 Read
via "Dark Reading".
Dark Reading
FBI, CISA Issue Joint Warning on 'Snatch' Ransomware-as-a-Service
The group's use of malware that forces Windows computers to reboot into Safe Mode before encrypting files is noteworthy, advisory says.
🕴 Fake WinRAR PoC Exploit Conceals VenomRAT Malware 🕴
📖 Read
via "Dark Reading".
A supposed exploit for a notable RCE vulnerability in the popular Windows file-archiving utility delivers a big sting for unwitting researchers and cybercriminals.📖 Read
via "Dark Reading".
Dark Reading
Fake WinRAR PoC Exploit Conceals VenomRAT Malware
A supposed exploit for a notable RCE vulnerability in the popular Windows file-archiving utility delivers a big sting for unwitting researchers and cybercriminals.
‼ CVE-2023-20594 ‼
📖 Read
via "National Vulnerability Database".
Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43377 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in /hoteldruid/visualizza_contratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the destinatario_email1 parameter.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-43371 ‼
📖 Read
via "National Vulnerability Database".
Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43373 ‼
📖 Read
via "National Vulnerability Database".
Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43376 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the nometipotariffa1 parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-20597 ‼
📖 Read
via "National Vulnerability Database".
Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40368 ‼
📖 Read
via "National Vulnerability Database".
IBM Storage Protect 8.1.0.0 through 8.1.19.0 could allow a privileged user to obtain sensitive information from the administrative command line client. IBM X-Force ID: 263456.📖 Read
via "National Vulnerability Database".