‼ CVE-2023-27121 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server v7.11.41.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cronString parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42824 ‼
📖 Read
via "National Vulnerability Database".
The issue was addressed with improved checks. This issue is fixed in iOS 17.0.3 and iPadOS 17.0.3. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5399 ‼
📖 Read
via "National Vulnerability Database".
A?CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')?vulnerability exists?that could cause?a path traversal issue?when?using the File Command. 📖 Read
via "National Vulnerability Database".
🕴 37% Intimidated, 39% Frustrated With Online Security Highlighting Digital Anxiety 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
37% Intimidated, 39% Frustrated With Online Security Highlighting Digital Anxiety
WASHINGTON – October 3, 2023 – The National Cybersecurity Alliance (NCA), the nation’s leading nonprofit empowering a more secure and interconnected world, and CybSafe, the leading behavioral risk platform, today announced the release of Oh Behave! The Annual…
🕴 Okta Launches Cybersecurity Workforce Development Initiative to Help Close the Tech and Cybersecurity Skills Gap 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
Okta Launches Cybersecurity Workforce Development Initiative to Help Close the Tech and Cybersecurity Skills Gap
SAN FRANCISCO — October 4, 2023 –– Okta, Inc. (NASDAQ:OKTA), the leading independent identity partner, today announced the launch of a new initiative focused on finding and developing the best cybersecurity talent and providing equitable access to thriving…
🕴 ForAllSecure Announces First Dynamic Software Bill of Materials for Application Security 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
ForAllSecure Announces Dynamic Software Bill of Materials for Application Security
PRESS RELEASE
❤1
‼ CVE-2023-36619 ‼
📖 Read
via "National Vulnerability Database".
Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43793 ‼
📖 Read
via "National Vulnerability Database".
Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42808 ‼
📖 Read
via "National Vulnerability Database".
Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets for training voice recognition-related tools. Version 1.88.2 is vulnerable to reflected Cross-Site Scripting given that user-controlled data flows to a path expression (path of a network request). This issue may lead to reflected Cross-Site Scripting (XSS) in the context of Common Voice’s server origin. As of time of publication, it is unknown whether any patches or workarounds exist.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41094 ‼
📖 Read
via "National Vulnerability Database".
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing durationThis issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38538 ‼
📖 Read
via "National Vulnerability Database".
A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43799 ‼
📖 Read
via "National Vulnerability Database".
Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system. Moreover, Altair GraphQL Client also does not isolate the context of the renderer process. This affects versions of the software running on MacOS, Windows, and Linux. Version 5.2.5 fixes this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36618 ‼
📖 Read
via "National Vulnerability Database".
Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of OS commands as root user by low-privileged authenticated users.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42809 ‼
📖 Read
via "National Vulnerability Database".
Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running in. Version 3.22.0 contains a patch for this issue.Some post-fix advice is available. Do NOT use `Kryo5Codec` as deserialization codec, as it is still vulnerable to arbitrary object deserialization due to the `setRegistrationRequired(false)` call. On the contrary, `KryoCodec` is safe to use. The fix applied to `SerializationCodec` only consists of adding an optional allowlist of class names, even though making this behavior the default is recommended. When instantiating `SerializationCodec` please use the `SerializationCodec(ClassLoader classLoader, Set<String> allowedClasses)` constructor to restrict the allowed classes for deserialization.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44075 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting vulnerability in Small CRM in PHP v.3.0 allows a remote attacker to execute arbitrary code via a crafted payload to the Address parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43805 ‼
📖 Read
via "National Vulnerability Database".
Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38537 ‼
📖 Read
via "National Vulnerability Database".
A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44210 ‼
📖 Read
via "National Vulnerability Database".
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 29258.📖 Read
via "National Vulnerability Database".