‼ CVE-2023-41668 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <=Â 1.1.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39189 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5459 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. VDB-241582 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41669 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Live News plugin <=Â 1.06 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41672 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Rémi Leclercq Hide admin notices – Admin Notification Center plugin <= 2.3.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39193 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3431 ‼
📖 Read
via "National Vulnerability Database".
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.📖 Read
via "National Vulnerability Database".
🕴 'Looney Tunables' Linux Flaw Sees Snowballing Proof-of-Concept Exploits 🕴
📖 Read
via "Dark Reading".
Following the publication of the critical Linux security vulnerability, security specialists released PoC exploits to test the implications of CVE-2023-4911.📖 Read
via "Dark Reading".
Dark Reading
'Looney Tunables' Linux Flaw Sees Snowballing Proof-of-Concept Exploits
Following the publication of the critical Linux security vulnerability, security specialists released PoC exploits to test the implications of CVE-2023-4911.
♟️ Phishers Spoof USPS, 12 Other Natl’ Postal Services ♟️
📖 Read
via "Krebs on Security".
Recent weeks have seen a sizable uptick in the number of phishing scams targeting U.S. Postal Service (USPS) customers. Here's a look at an extensive SMS phishing operation that tries to steal personal and financial data by spoofing the USPS, as well as postal services in at least a dozen other countries worldwide.📖 Read
via "Krebs on Security".
Krebs on Security
Phishers Spoof USPS, 12 Other Natl’ Postal Services
Recent weeks have seen a sizable uptick in the number of phishing scams targeting U.S. Postal Service (USPS) customers. Here's a look at an extensive SMS phishing operation that tries to steal personal and financial data by spoofing the USPS,…
🕴 Hacktivists Enter Fray Following Hamas Strikes Against Israel 🕴
📖 Read
via "Dark Reading".
Killnet, Anonymous Sudan, along with other groups, pick up up their Middle East activities as war breaks out.📖 Read
via "Dark Reading".
Dark Reading
Hacktivists Enter Fray Following Hamas Strikes Against Israel
Killnet, Anonymous Sudan, along with other groups, pick up up their Middle East activities as war breaks out.
‼ CVE-2022-3728 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44811 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44813 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48183 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44821 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in gifsicle v.1.92 allows a remote attacker to cause a denial of service via the --crop parameter in the command line parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44467 ‼
📖 Read
via "National Vulnerability Database".
langchain_experimental 0.0.14 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via the PALChain in the python exec method.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48182 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44392 ‼
📖 Read
via "National Vulnerability Database".
Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the Kubernetes `ConfigMap` resources prefixed with `test-result` and `run-result` to cache Garden test and run results. These `ConfigMaps` are stored either in the `garden-system` namespace or the configured user namespace. When a user invokes the command `garden test` or `garden run` objects stored in the `ConfigMap` are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the `ConfigMap`, which can trigger a remote code execution on the users machine when cryo deserializes the object. In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a `garden test` or `garden run` which has previously cached results. The issue has been patched in Garden versions `0.13.17` (Bonsai) and `0.12.65` (Acorn). Only Garden versions prior to these are vulnerable. No known workarounds are available.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5461 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Handler. The manipulation leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241584. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44812 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43271 ‼
📖 Read
via "National Vulnerability Database".
Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols.📖 Read
via "National Vulnerability Database".