‼ CVE-2023-42818 ‼
📖 Read
via "National Vulnerability Database".
JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40026 ‼
📖 Read
via "National Vulnerability Database".
Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 (starting at least in v0.1.0, but likely in any version using Helm before 2.3), using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was possible because Helm paths were predictable. The vulnerability worked by adding a Helm chart that referenced Helm resources from predictable paths. Because the paths of Helm charts were predictable and available on an instance of repo-server, it was possible to reference and then render the values and resources from other existing Helm charts regardless of permissions. While generally, secrets are not stored in these files, it was nevertheless possible to reference any values from these charts. This issue was fixed in Argo CD 2.3 and subsequent versions by randomizing Helm paths. User's still using Argo CD 2.3 or below are advised to update to a supported version. If this is not possible, disabling Helm chart rendering, or using an additional repo-server for each Helm chart would prevent possible exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43651 ‼
📖 Read
via "National Vulnerability Database".
JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI interface provided by the koko component, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands. This vulnerability has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4066 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44047 ‼
📖 Read
via "National Vulnerability Database".
Sourcecodester Toll Tax Management System v1 is vulnerable to SQL Injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44048 ‼
📖 Read
via "National Vulnerability Database".
Sourcecodester Expense Tracker App v1 is vulnerable to Cross Site Scripting (XSS) via add category.📖 Read
via "National Vulnerability Database".
🕴 Fortinet Announces Formation of Veterans Program Advisory Council to Narrow the Cybersecurity Skills Gap With Military Veteran Talent 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
Fortinet Announces Formation of Veterans Program Advisory Council to Narrow the Cybersecurity Skills Gap With Military Veteran…
SUNNYVALE, Calif. - Sep 27, 2023 —
🕴 Radiant Logic Announces Expanded Identity Analytics and Data Management Platform Capabilities 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
Radiant Logic Announces Expanded Identity Analytics and Data Management Platform Capabilities
Novato, California, September 27, 2023 – Radiant Logic, the Identity Data Fabric company, today announces the completed integration of Brainwave GRC following the April 2023 acquisition. These new capabilities solidify Radiant Logic’s entrance in the Identity…
🕴 A Preview of Windows 11’s Passkeys Support 🕴
📖 Read
via "Dark Reading".
The latest update to Windows 11 introduces support for passkeys, which provide phishing-resistant passwordless authentication.📖 Read
via "Dark Reading".
Dark Reading
A Preview of Windows 11's Passkeys Support
The latest update to Windows 11 introduces support for passkeys, which provide phishing-resistant passwordless authentication.
‼ CVE-2023-38871 ‼
📖 Read
via "National Vulnerability Database".
The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41447 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the subcmd parameter in the index.php component.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41450 ‼
📖 Read
via "National Vulnerability Database".
An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5244 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38877 ‼
📖 Read
via "National Vulnerability Database".
A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords.📖 Read
via "National Vulnerability Database".
🕴 CAPTCHAs Easy for Humans, Hard for Bots 🕴
📖 Read
via "Dark Reading".
Proton is aiming for the sweet spot between security, privacy, and accessibility with its CAPTCHA.📖 Read
via "Dark Reading".
Dark Reading
CAPTCHAs Easy for Humans, Hard for Bots
Proton is aiming for the sweet spot between security, privacy, and accessibility with its CAPTCHA.
‼ CVE-2023-38872 ‼
📖 Read
via "National Vulnerability Database".
An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42222 ‼
📖 Read
via "National Vulnerability Database".
WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38874 ‼
📖 Read
via "National Vulnerability Database".
A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and execute arbitrary commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44273 ‼
📖 Read
via "National Vulnerability Database".
Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38873 ‼
📖 Read
via "National Vulnerability Database".
The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41446 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted script to the title parameter in the index.php component.📖 Read
via "National Vulnerability Database".