βΌ CVE-2023-4156 βΌ
π Read
via "National Vulnerability Database".
A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.π Read
via "National Vulnerability Database".
βΌ CVE-2023-39640 βΌ
π Read
via "National Vulnerability Database".
UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList().π Read
via "National Vulnerability Database".
βΌ CVE-2023-41867 βΌ
π Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AcyMailing Newsletter Team AcyMailing plugin <=Γ 8.6.2 versions.π Read
via "National Vulnerability Database".
βΌ CVE-2023-41863 βΌ
π Read
via "National Vulnerability Database".
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Pepro Dev. Group PeproDev CF7 Database plugin <=Γ 1.7.0 versions.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43319 βΌ
π Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in the Sign-In page of IceWarp WebClient 10.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.π Read
via "National Vulnerability Database".
βΌ CVE-2023-42817 βΌ
π Read
via "National Vulnerability Database".
Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including Γ’β¬Ε%sΓ’β¬οΏ½ (from Γ’β¬Ε%suggest%) is parsed by sprintf() even though itΓ’β¬β’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain Γ’β¬ΕmodulesΓ’β¬οΏ½) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.π Read
via "National Vulnerability Database".
βΌ CVE-2023-40581 βΌ
π Read
via "National Vulnerability Database".
yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata values may be used in the shell commands. The metadata fields can be combined with the `%q` conversion, which is intended to quote/escape these values so they can be safely passed to the shell. However, the escaping used for `cmd` (the shell used by Python's `subprocess` on Windows) does not properly escape special characters, which can allow for remote code execution if `--exec` is used directly with maliciously crafted remote data. This vulnerability only impacts `yt-dlp` on Windows, and the vulnerability is present regardless of whether `yt-dlp` is run from `cmd` or from `PowerShell`. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2023.09.24 fixes this issue by properly escaping each special character. `\n` will be replaced by `\r` as no way of escaping it has been found. It is recommended to upgrade yt-dlp to version 2023.09.24 as soon as possible. Also, always be careful when using --exec, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade: 1. Avoid using any output template expansion in --exec other than {} (filepath). 2. If expansion in --exec is needed, verify the fields you are using do not contain ", | or &. 3. Instead of using --exec, write the info json and load the fields from it instead.π Read
via "National Vulnerability Database".
π΄ UAE-Linked 'Stealth Falcon' APT Mimics Microsoft in Homoglyph Attack π΄
π Read
via "Dark Reading".
The cyberattackers are using the "Deadglyph" custom spyware, whose full capabilities have not yet been uncovered.π Read
via "Dark Reading".
Dark Reading
UAE-Linked 'Stealth Falcon' APT Mimics Microsoft in Homoglyph Attack
The cyberattackers are using the "Deadglyph" custom spyware, whose full capabilities have not yet been uncovered.
π΄ MOVEit Flaw Leads to 900 University Data Breaches π΄
π Read
via "Dark Reading".
National Student Clearinghouse, a nonprofit serving thousands of universities with enrollment services, exposes more than 900 schools within its MOVEit environment. π Read
via "Dark Reading".
Dark Reading
MOVEit Flaw Leads to 900 University Data Breaches
National Student Clearinghouse, a nonprofit serving thousands of universities with enrollment services, exposes more than 900 schools within its MOVEit environment.
π΄ Xenomorph Android Malware Targets Customers of 30 US Banks π΄
π Read
via "Dark Reading".
The Trojan had mainly been infecting banks in Europe since it first surfaced more than one year ago.π Read
via "Dark Reading".
Dark Reading
Xenomorph Android Malware Targets Customers of 30 US Banks
The Trojan had mainly been infecting banks in Europe since it first surfaced more than one year ago.
βΌ CVE-2022-4245 βΌ
π Read
via "National Vulnerability Database".
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.π Read
via "National Vulnerability Database".
βΌ CVE-2022-4318 βΌ
π Read
via "National Vulnerability Database".
A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43642 βΌ
π Read
via "National Vulnerability Database".
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.π Read
via "National Vulnerability Database".
βΌ CVE-2022-4137 βΌ
π Read
via "National Vulnerability Database".
A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.π Read
via "National Vulnerability Database".
βΌ CVE-2022-4244 βΌ
π Read
via "National Vulnerability Database".
A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43132 βΌ
π Read
via "National Vulnerability Database".
szvone vmqphp <=1.13 is vulnerable to SQL Injection. Unauthorized remote users can use sql injection attacks to obtain the hash of the administrator password.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43644 βΌ
π Read
via "National Vulnerability Database".
Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to sing-box 1.4.4 or to 1.5.0-rc.4. Users unable to update should not expose the SOCKS5 inbound to insecure environments.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43457 βΌ
π Read
via "National Vulnerability Database".
An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint.π Read
via "National Vulnerability Database".
βΌ CVE-2023-42753 βΌ
π Read
via "National Vulnerability Database".
An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.π Read
via "National Vulnerability Database".
βΌ CVE-2023-42426 βΌ
π Read
via "National Vulnerability Database".
Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43458 βΌ
π Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in Resort Reservation System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the room, name, and description parameters in the manage_room function.π Read
via "National Vulnerability Database".