‼ CVE-2023-39193 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3431 ‼
📖 Read
via "National Vulnerability Database".
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.📖 Read
via "National Vulnerability Database".
🕴 'Looney Tunables' Linux Flaw Sees Snowballing Proof-of-Concept Exploits 🕴
📖 Read
via "Dark Reading".
Following the publication of the critical Linux security vulnerability, security specialists released PoC exploits to test the implications of CVE-2023-4911.📖 Read
via "Dark Reading".
Dark Reading
'Looney Tunables' Linux Flaw Sees Snowballing Proof-of-Concept Exploits
Following the publication of the critical Linux security vulnerability, security specialists released PoC exploits to test the implications of CVE-2023-4911.
♟️ Phishers Spoof USPS, 12 Other Natl’ Postal Services ♟️
📖 Read
via "Krebs on Security".
Recent weeks have seen a sizable uptick in the number of phishing scams targeting U.S. Postal Service (USPS) customers. Here's a look at an extensive SMS phishing operation that tries to steal personal and financial data by spoofing the USPS, as well as postal services in at least a dozen other countries worldwide.📖 Read
via "Krebs on Security".
Krebs on Security
Phishers Spoof USPS, 12 Other Natl’ Postal Services
Recent weeks have seen a sizable uptick in the number of phishing scams targeting U.S. Postal Service (USPS) customers. Here's a look at an extensive SMS phishing operation that tries to steal personal and financial data by spoofing the USPS,…
🕴 Hacktivists Enter Fray Following Hamas Strikes Against Israel 🕴
📖 Read
via "Dark Reading".
Killnet, Anonymous Sudan, along with other groups, pick up up their Middle East activities as war breaks out.📖 Read
via "Dark Reading".
Dark Reading
Hacktivists Enter Fray Following Hamas Strikes Against Israel
Killnet, Anonymous Sudan, along with other groups, pick up up their Middle East activities as war breaks out.
‼ CVE-2022-3728 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44811 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44813 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48183 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44821 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in gifsicle v.1.92 allows a remote attacker to cause a denial of service via the --crop parameter in the command line parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44467 ‼
📖 Read
via "National Vulnerability Database".
langchain_experimental 0.0.14 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via the PALChain in the python exec method.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48182 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44392 ‼
📖 Read
via "National Vulnerability Database".
Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the Kubernetes `ConfigMap` resources prefixed with `test-result` and `run-result` to cache Garden test and run results. These `ConfigMaps` are stored either in the `garden-system` namespace or the configured user namespace. When a user invokes the command `garden test` or `garden run` objects stored in the `ConfigMap` are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the `ConfigMap`, which can trigger a remote code execution on the users machine when cryo deserializes the object. In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a `garden test` or `garden run` which has previously cached results. The issue has been patched in Garden versions `0.13.17` (Bonsai) and `0.12.65` (Acorn). Only Garden versions prior to these are vulnerable. No known workarounds are available.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5461 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Handler. The manipulation leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241584. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44812 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43271 ‼
📖 Read
via "National Vulnerability Database".
Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36228 ‼
📖 Read
via "National Vulnerability Database".
Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the device password in the Nokelock app.📖 Read
via "National Vulnerability Database".
🦿 Private Internet Access VPN: A Comprehensive Review for 2023 🦿
📖 Read
via "Tech Republic".
When it comes to privacy and security, PIA VPN is among the best. Discover its features, performance, pricing and more with this in-depth review.📖 Read
via "Tech Republic".
TechRepublic
Private Internet Access VPN Review: How Good Is PIA VPN?
Private Internet Access VPN offers great privacy at a low cost, but can it keep up with top VPN providers in terms of speed and user experience?
‼ CVE-2023-43899 ‼
📖 Read
via "National Vulnerability Database".
hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5463 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in XINJE XDPPro up to 3.7.17a. It has been rated as critical. Affected by this issue is some unknown functionality in the library cfgmgr32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. VDB-241586 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5462 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in XINJE XD5E-30R-E 3.5.3b. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Modbus Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier VDB-241585 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".