‼ CVE-2023-31717 ‼
📖 Read
via "National Vulnerability Database".
A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23362 ‼
📖 Read
via "National Vulnerability Database".
An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.We have already fixed the vulnerability in the following versions:QTS 5.0.1.2376 build 20230421 and laterQTS 4.5.4.2374 build 20230416 and laterQuTS hero h5.0.1.2376 build 20230421 and laterQuTS hero h4.5.4.2374 build 20230417 and laterQuTScloud c5.0.1.2374 and later📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23364 ‼
📖 Read
via "National Vulnerability Database".
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors.We have already fixed the vulnerability in the following versions:Multimedia Console 2.1.1 ( 2023/03/29 ) and laterMultimedia Console 1.4.7 ( 2023/03/20 ) and later📖 Read
via "National Vulnerability Database".
‼ CVE-2023-31718 ‼
📖 Read
via "National Vulnerability Database".
FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23363 ‼
📖 Read
via "National Vulnerability Database".
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors.We have already fixed the vulnerability in the following versions:QTS 4.3.6.2441 build 20230621 and laterQTS 4.3.3.2420 build 20230621 and laterQTS 4.2.6 build 20230621 and laterQTS 4.3.4.2451 build 20230621 and later📖 Read
via "National Vulnerability Database".
‼ CVE-2023-31716 ‼
📖 Read
via "National Vulnerability Database".
FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log📖 Read
via "National Vulnerability Database".
🕴 Guardians of the Cyberverse: Building a Resilient Security Culture 🕴
📖 Read
via "Dark Reading".
Whether achieved through AI-enabled automation, proactive identification and resolution of issues, or the equitable distribution of risk management responsibilities, the goal must be resilience.📖 Read
via "Dark Reading".
Dark Reading
Guardians of the Cyberverse: Building a Resilient Security Culture
Whether achieved through AI-enabled automation, proactive identification and resolution of issues, or the equitable distribution of risk management responsibilities, the goal must be resilience.
🕴 ASPM Is Good, But It's Not a Cure-All for App Security 🕴
📖 Read
via "Dark Reading".
What application security posture management does, it does well. But you'll still need to fill in some holes, especially concerning API security.📖 Read
via "Dark Reading".
Dark Reading
ASPM Is Good, But It's Not a Cure-All for App Security
What application security posture management does, it does well. But you'll still need to fill in some holes, especially concerning API security.
🦿 7 Best Cloud Security Posture Management (CSPM) Software for 2023 🦿
📖 Read
via "Tech Republic".
What is the best CSPM tool for your business? Use our guide to review our picks for the best cloud security posture management (CSPM) tools for 2023.📖 Read
via "Tech Republic".
TechRepublic
Best CSPM Tools 2024: Top Cloud Security Solutions Compared
We've revisited the best CSPM tools for 2024, comparing updated features, pricing, and integrations to help secure your cloud environments effectively.
📢 Ransomware groups are once again targeting smaller businesses for more lucrative payouts 📢
📖 Read
via "ITPro".
Lower hanging fruit represents a far more lucrative revenue stream for groups such as LockBit 📖 Read
via "ITPro".
ITPro
Ransomware groups are once again targeting smaller businesses for more lucrative payouts
Lower-hanging fruit represents a far more lucrative revenue stream for groups such as LockBit
‼ CVE-2023-34319 ‼
📖 Read
via "National Vulnerability Database".
The fix for XSA-423 added logic to Linux'es netback driver to deal witha frontend splitting a packet in a way such that not all of the headerswould come in one piece. Unfortunately the logic introduced theredidn't account for the extreme case of the entire packet being splitinto as many pieces as permitted by the protocol, yet still beingsmaller than the area that's specially dealt with to keep all (possible)headers together. Such an unusual packet would therefore trigger abuffer overrun in the driver.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3874 ‼
📖 Read
via "National Vulnerability Database".
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23766 ‼
📖 Read
via "National Vulnerability Database".
An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened Pull Request. To do so, an attacker would need write access to the repository. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in versions 3.6.17, 3.7.15, 3.8.8, 3.9.3, and 3.10.1. This vulnerability was reported via the GitHub Bug Bounty program.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43144 ‼
📖 Read
via "National Vulnerability Database".
Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4039 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5002 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41029 ‼
📖 Read
via "National Vulnerability Database".
Command injection vulnerability in the homemng.htm endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows authenticated remote attackers to execute commands as root via specially crafted HTTP requests to the vulnerable endpoint.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42821 ‼
📖 Read
via "National Vulnerability Database".
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `0.0.0-20230922105210-14b16010c2ee`, which corresponds with commit `14b16010c2ee7ff33a940a541d993bd043a88940`, parsing malformed markdown input with parser that uses parser.Mmark extension could result in out-of-bounds read vulnerability. To exploit the vulnerability, parser needs to have `parser.Mmark` extension set. The panic occurs inside the `citation.go` file on the line 69 when the parser tries to access the element past its length. This can result in a denial of service. Commit `14b16010c2ee7ff33a940a541d993bd043a88940`/pseudoversion `0.0.0-20230922105210-14b16010c2ee` contains a patch for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42798 ‼
📖 Read
via "National Vulnerability Database".
AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the `PROJECT_PATH_RELEASE` (e.g. `releases/`) directory is manually and actually `git cloned` properly, making it a different git repostiory from the root git repository.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42811 ‼
📖 Read
via "National Vulnerability Database".
aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42812 ‼
📖 Read
via "National Vulnerability Database".
Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which allows a malicious to issue arbitrary HTTP/HTTPS requests from the application server to internal hosts and read their responses. Version 22.05 contains a patch for this issue.📖 Read
via "National Vulnerability Database".