‼ CVE-2023-38874 ‼
📖 Read
via "National Vulnerability Database".
A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and execute arbitrary commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44273 ‼
📖 Read
via "National Vulnerability Database".
Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38873 ‼
📖 Read
via "National Vulnerability Database".
The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41446 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted script to the title parameter in the index.php component.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38870 ‼
📖 Read
via "National Vulnerability Database".
A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQL Injection.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-41444 ‼
📖 Read
via "National Vulnerability Database".
An issue in Binalyze IREC.sys v.3.11.0 and before allows a local attacker to execute arbitrary code and escalate privileges via the fun_1400084d0 function in IREC.sys driver.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44275 ‼
📖 Read
via "National Vulnerability Database".
OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5230 ‼
📖 Read
via "National Vulnerability Database".
The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcode in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44276 ‼
📖 Read
via "National Vulnerability Database".
OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26145 ‼
📖 Read
via "National Vulnerability Database".
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.**Note:**The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible)2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5232 ‼
📖 Read
via "National Vulnerability Database".
The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and including, 3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26149 ‼
📖 Read
via "National Vulnerability Database".
Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList function. **Note:**If the mentions list is sourced from unsafe (user-sourced) data, this might allow an injection attack when a Quill user hits @.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5233 ‼
📖 Read
via "National Vulnerability Database".
The Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fawesome' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.📖 Read
via "National Vulnerability Database".
📢 Life after the cookie has crumbled 📢
📖 Read
via "ITPro".
With cookies expected to be phased out in the next few years, businesses will be seeking new avenues to gain first-party data 📖 Read
via "ITPro".
ITPro
Life after the cookie has crumbled
With cookies expected to be phased out in the next few years, businesses will be seeking new avenues to gain first-party data
📢 ICO warns against Excel spreadsheets to curb public sector data breaches 📢
📖 Read
via "ITPro".
The ICO's advisory follows a spate of data protection blunders at UK police forces in recent months 📖 Read
via "ITPro".
ITPro
ICO warns against Excel spreadsheets to curb public sector data breaches
The ICO's advisory follows a spate of data protection blunders at UK police forces in recent months
🕴 Supply Chain Attackers Escalate With GitHub Dependabot Impersonation 🕴
📖 Read
via "Dark Reading".
Armed with stolen developer passcodes, attackers have checked in changes to repositories under the automation feature's name in an attempt to escape notice.📖 Read
via "Dark Reading".
Dark Reading
Supply Chain Attackers Escalate With GitHub Dependabot Impersonation
Armed with stolen developer passcodes, attackers have checked in changes to repositories under the automation feature's name in an attempt to escape notice.
🕴 4 Legal Surprises You May Encounter After a Cybersecurity Incident 🕴
📖 Read
via "Dark Reading".
Many organizations are not prepared to respond to all the constituencies that come knocking after a breach or ransomware incident.📖 Read
via "Dark Reading".
Dark Reading
4 Legal Surprises You May Encounter After a Cybersecurity Incident
Many organizations are not prepared to respond to all the constituencies that come knocking after a breach or ransomware incident.
‼ CVE-2023-43869 ‼
📖 Read
via "National Vulnerability Database".
D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard56 Function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43861 ‼
📖 Read
via "National Vulnerability Database".
D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPPoE function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43860 ‼
📖 Read
via "National Vulnerability Database".
D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanNonLogin function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43876 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.📖 Read
via "National Vulnerability Database".