βΌ CVE-2023-43131 βΌ
π Read
via "National Vulnerability Database".
General Device Manager 2.5.2.2 is vulnerable to Buffer Overflow.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43456 βΌ
π Read
via "National Vulnerability Database".
Cross Site Scripting vulnerability in Service Provider Management System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the firstname, middlename and lastname parameters in the /php-spms/admin/?page=user endpoint.π Read
via "National Vulnerability Database".
π¦Ώ LogRhythm vs. SolarWinds (2023): SIEM Tool Comparison π¦Ώ
π Read
via "Tech Republic".
This is an in-depth LogRhythm vs. SolarWinds SIEM tool comparison, covering their key features, pricing, and more. Use this guide to find your best fit.π Read
via "Tech Republic".
TechRepublic
LogRhythm vs SolarWinds (2024): SIEM Tool Comparison
Compare LogRhythm and SolarWinds SIEM tools in 2024. Explore features, pricing, performance, and reviews to find the best solution for your security needs.
π¦Ώ How to Compare the Contents of Local & Remote Files With the Help of SSH π¦Ώ
π Read
via "Tech Republic".
This is a step-by-step guide on how to compare the contents of local and remote files with the help of SSH. Watch the companion video tutorial by Jack Wallen.π Read
via "Tech Republic".
TechRepublic
How to Compare the Contents of Local & Remote Files With the Help of SSH
This is a step-by-step guide on how to compare the contents of local and remote files with the help of SSH. Watch our related video tutorial.
π¦Ώ How to Compare the Contents of Local & Remote Files with the Help of SSH π¦Ώ
π Read
via "Tech Republic".
This is a step-by-step guide on how to compare the contents of local and remote files with the help of SSH. Watch our video tutorial to help you learn.π Read
via "Tech Republic".
TechRepublic
Video Tutorial: How to Compare the Contents of Local & Remote Files with the Help of SSH
This is a step-by-step guide on how to compare the contents of local and remote files with the help of SSH. Watch our video tutorial.
βΌ CVE-2023-41868 βΌ
π Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ram Ratan Maurya, Codestag StagTools plugin <=Γ 2.3.7 versions.π Read
via "National Vulnerability Database".
βΌ CVE-2023-41871 βΌ
π Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Poll Maker Team Poll Maker plugin <=Γ 4.7.0 versions.π Read
via "National Vulnerability Database".
βΌ CVE-2023-4156 βΌ
π Read
via "National Vulnerability Database".
A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.π Read
via "National Vulnerability Database".
βΌ CVE-2023-39640 βΌ
π Read
via "National Vulnerability Database".
UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList().π Read
via "National Vulnerability Database".
βΌ CVE-2023-41867 βΌ
π Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AcyMailing Newsletter Team AcyMailing plugin <=Γ 8.6.2 versions.π Read
via "National Vulnerability Database".
βΌ CVE-2023-41863 βΌ
π Read
via "National Vulnerability Database".
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Pepro Dev. Group PeproDev CF7 Database plugin <=Γ 1.7.0 versions.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43319 βΌ
π Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in the Sign-In page of IceWarp WebClient 10.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.π Read
via "National Vulnerability Database".
βΌ CVE-2023-42817 βΌ
π Read
via "National Vulnerability Database".
Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including Γ’β¬Ε%sΓ’β¬οΏ½ (from Γ’β¬Ε%suggest%) is parsed by sprintf() even though itΓ’β¬β’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain Γ’β¬ΕmodulesΓ’β¬οΏ½) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.π Read
via "National Vulnerability Database".
βΌ CVE-2023-40581 βΌ
π Read
via "National Vulnerability Database".
yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata values may be used in the shell commands. The metadata fields can be combined with the `%q` conversion, which is intended to quote/escape these values so they can be safely passed to the shell. However, the escaping used for `cmd` (the shell used by Python's `subprocess` on Windows) does not properly escape special characters, which can allow for remote code execution if `--exec` is used directly with maliciously crafted remote data. This vulnerability only impacts `yt-dlp` on Windows, and the vulnerability is present regardless of whether `yt-dlp` is run from `cmd` or from `PowerShell`. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2023.09.24 fixes this issue by properly escaping each special character. `\n` will be replaced by `\r` as no way of escaping it has been found. It is recommended to upgrade yt-dlp to version 2023.09.24 as soon as possible. Also, always be careful when using --exec, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade: 1. Avoid using any output template expansion in --exec other than {} (filepath). 2. If expansion in --exec is needed, verify the fields you are using do not contain ", | or &. 3. Instead of using --exec, write the info json and load the fields from it instead.π Read
via "National Vulnerability Database".
π΄ UAE-Linked 'Stealth Falcon' APT Mimics Microsoft in Homoglyph Attack π΄
π Read
via "Dark Reading".
The cyberattackers are using the "Deadglyph" custom spyware, whose full capabilities have not yet been uncovered.π Read
via "Dark Reading".
Dark Reading
UAE-Linked 'Stealth Falcon' APT Mimics Microsoft in Homoglyph Attack
The cyberattackers are using the "Deadglyph" custom spyware, whose full capabilities have not yet been uncovered.
π΄ MOVEit Flaw Leads to 900 University Data Breaches π΄
π Read
via "Dark Reading".
National Student Clearinghouse, a nonprofit serving thousands of universities with enrollment services, exposes more than 900 schools within its MOVEit environment. π Read
via "Dark Reading".
Dark Reading
MOVEit Flaw Leads to 900 University Data Breaches
National Student Clearinghouse, a nonprofit serving thousands of universities with enrollment services, exposes more than 900 schools within its MOVEit environment.
π΄ Xenomorph Android Malware Targets Customers of 30 US Banks π΄
π Read
via "Dark Reading".
The Trojan had mainly been infecting banks in Europe since it first surfaced more than one year ago.π Read
via "Dark Reading".
Dark Reading
Xenomorph Android Malware Targets Customers of 30 US Banks
The Trojan had mainly been infecting banks in Europe since it first surfaced more than one year ago.
βΌ CVE-2022-4245 βΌ
π Read
via "National Vulnerability Database".
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.π Read
via "National Vulnerability Database".
βΌ CVE-2022-4318 βΌ
π Read
via "National Vulnerability Database".
A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43642 βΌ
π Read
via "National Vulnerability Database".
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.π Read
via "National Vulnerability Database".
βΌ CVE-2022-4137 βΌ
π Read
via "National Vulnerability Database".
A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.π Read
via "National Vulnerability Database".