‼ CVE-2023-44228 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Onclick show popup plugin <=Â 8.1 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44263 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Riyaz Social Metrics plugin <=Â 2.2 versions.📖 Read
via "National Vulnerability Database".
🕴 Making Sense of Today's Payment Cybersecurity Landscape 🕴
📖 Read
via "Dark Reading".
PCI DSS v4.0 is the future of the payment card industry's information security standard, but businesses must continue to look beyond this guidance and engage in proactive strategies of their own.📖 Read
via "Dark Reading".
Dark Reading
Making Sense of Today's Payment Cybersecurity Landscape
PCI DSS v4.0 is the future of the payment card industry's information security standard, but businesses must continue to look beyond this guidance and engage in proactive strategies of their own.
‼ CVE-2023-5106 ‼
📖 Read
via "National Vulnerability Database".
An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41580 ‼
📖 Read
via "National Vulnerability Database".
Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted POST request.📖 Read
via "National Vulnerability Database".
🛠 TOR Virtual Network Tunneling Tool 0.4.8.7 🛠
📖 Read
via "Packet Storm Security".
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs). This is the source code release.📖 Read
via "Packet Storm Security".
Packetstormsecurity
TOR Virtual Network Tunneling Tool 0.4.8.7 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🛠 jSQL Injection 0.93 🛠
📖 Read
via "Packet Storm Security".
jSQL Injection is a lightweight application used to find database information from a distant server. jSQL Injection is also part of the official penetration testing distribution Kali Linux and is included in various other distributions like Pentest Box, Parrot Security OS, ArchStrike and BlackArch Linux. This is the source code release.📖 Read
via "Packet Storm Security".
Packetstormsecurity
jSQL Injection 0.93 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
♟️ Don’t Let Zombie Zoom Links Drag You Down ♟️
📖 Read
via "Krebs on Security".
Many organizations — including quite a few Fortune 500 firms — have exposed web links that allow anyone to initiate a Zoom video conference meeting as a valid employee. These company-specific Zoom links, which include a permanent user ID number and an embedded passcode, can work indefinitely and expose an organization’s employees, customers or partners to phishing and other social engineering attacks.📖 Read
via "Krebs on Security".
Krebs on Security
Don’t Let Zombie Zoom Links Drag You Down
Many organizations — including quite a few Fortune 500 firms — have exposed web links that allow anyone to initiate a Zoom video conference meeting as a valid employee. These company-specific Zoom links, which include a permanent user ID number…
‼ CVE-2023-4659 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an unprivileged remote user is able to create, delete and modify users within theapplication.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3769 ‼
📖 Read
via "National Vulnerability Database".
Incorrect data input validation vulnerability, which could allow an attacker with access to the network to implement fuzzing techniques that would allow him to gain knowledge about specially crafted packets that would create a DoS condition through the MMS protocol when initiating communication, achieving a complete system reboot of the device and its services.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3770 ‼
📖 Read
via "National Vulnerability Database".
 Incorrect validation vulnerability of the data entered, allowing an attacker with access to the network on which the affected device is located to use the discovery port protocol (1925/UDP) to obtain device-specific information without the need for authentication.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3744 ‼
📖 Read
via "National Vulnerability Database".
Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in the imageURL parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5290 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2015-10124 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Most Popular Posts Widget Plugin up to 0.8 on WordPress. It has been classified as critical. Affected is the function add_views/show_views of the file functions.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 0.9 is able to address this issue. The patch is identified as a99667d11ac8d320006909387b100e9a8b5c12e1. It is recommended to upgrade the affected component. VDB-241026 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
🕴 Iran-Linked APT34 Spy Campaign Targets Saudis 🕴
📖 Read
via "Dark Reading".
The Menorah malware can upload and download files, as well as execute shell commands.📖 Read
via "Dark Reading".
Dark Reading
Iran-Linked APT34 Spy Campaign Targets Saudis
The Menorah malware can upload and download files, as well as execute shell commands.
🕴 Which DFIR Challenges Does the Middle East Face? 🕴
📖 Read
via "Dark Reading".
Demand for digital forensics and incident response (DFIR) surges in the Middle East, a new IDC report finds. Is automation the answer?📖 Read
via "Dark Reading".
Dark Reading
Which DFIR Challenges Does the Middle East Face?
Demand for digital forensics and incident response (DFIR) surges in the Middle East, a new IDC report finds. Is automation the answer?
🕴 Norway Urges Europe-Wide Ban on Meta's Targeted Ad Data Collection 🕴
📖 Read
via "Dark Reading".
Norway wants to permanently ban the owner of Facebook and Instagram from collecting sensitive user data across Europe, saying its current policies violate GDPR rules.📖 Read
via "Dark Reading".
Dark Reading
Norway Urges Europe-Wide Ban on Meta's Targeted Ad Data Collection
Norway wants to permanently ban the owner of Facebook and Instagram from collecting sensitive user data across Europe, saying its current policies violate GDPR rules.
🕴 FBI: Crippling 'Dual Ransomware Attacks' on the Rise 🕴
📖 Read
via "Dark Reading".
Once they compromise an victim with an initial ransomware attack, threat actors are ready to deploy a secondary attack with a different strain, which could leave even more damage.📖 Read
via "Dark Reading".
Dark Reading
FBI: Crippling 'Dual Ransomware Attacks' on the Rise
Once they compromise an victim with an initial ransomware attack, threat actors are ready to deploy a secondary attack with a different strain, which could leave even more damage.
‼ CVE-2023-37605 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in baramundi software GmbH EMM Agent 23.1.50 and before allows an attacker to cause a denial of service via a crafted request to the password parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40744 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2023. Notes: none.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-0809 ‼
📖 Read
via "National Vulnerability Database".
In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.📖 Read
via "National Vulnerability Database".