🕴 'Looney Tunables' Linux Flaw Sees Snowballing Proof-of-Concept Exploits 🕴
📖 Read
via "Dark Reading".
Following the publication of the critical Linux security vulnerability, security specialists released PoC exploits to test the implications of CVE-2023-4911.📖 Read
via "Dark Reading".
Dark Reading
'Looney Tunables' Linux Flaw Sees Snowballing Proof-of-Concept Exploits
Following the publication of the critical Linux security vulnerability, security specialists released PoC exploits to test the implications of CVE-2023-4911.
♟️ Phishers Spoof USPS, 12 Other Natl’ Postal Services ♟️
📖 Read
via "Krebs on Security".
Recent weeks have seen a sizable uptick in the number of phishing scams targeting U.S. Postal Service (USPS) customers. Here's a look at an extensive SMS phishing operation that tries to steal personal and financial data by spoofing the USPS, as well as postal services in at least a dozen other countries worldwide.📖 Read
via "Krebs on Security".
Krebs on Security
Phishers Spoof USPS, 12 Other Natl’ Postal Services
Recent weeks have seen a sizable uptick in the number of phishing scams targeting U.S. Postal Service (USPS) customers. Here's a look at an extensive SMS phishing operation that tries to steal personal and financial data by spoofing the USPS,…
🕴 Hacktivists Enter Fray Following Hamas Strikes Against Israel 🕴
📖 Read
via "Dark Reading".
Killnet, Anonymous Sudan, along with other groups, pick up up their Middle East activities as war breaks out.📖 Read
via "Dark Reading".
Dark Reading
Hacktivists Enter Fray Following Hamas Strikes Against Israel
Killnet, Anonymous Sudan, along with other groups, pick up up their Middle East activities as war breaks out.
‼ CVE-2022-3728 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44811 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44813 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48183 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44821 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in gifsicle v.1.92 allows a remote attacker to cause a denial of service via the --crop parameter in the command line parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44467 ‼
📖 Read
via "National Vulnerability Database".
langchain_experimental 0.0.14 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via the PALChain in the python exec method.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48182 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44392 ‼
📖 Read
via "National Vulnerability Database".
Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the Kubernetes `ConfigMap` resources prefixed with `test-result` and `run-result` to cache Garden test and run results. These `ConfigMaps` are stored either in the `garden-system` namespace or the configured user namespace. When a user invokes the command `garden test` or `garden run` objects stored in the `ConfigMap` are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the `ConfigMap`, which can trigger a remote code execution on the users machine when cryo deserializes the object. In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a `garden test` or `garden run` which has previously cached results. The issue has been patched in Garden versions `0.13.17` (Bonsai) and `0.12.65` (Acorn). Only Garden versions prior to these are vulnerable. No known workarounds are available.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5461 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Handler. The manipulation leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241584. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44812 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43271 ‼
📖 Read
via "National Vulnerability Database".
Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36228 ‼
📖 Read
via "National Vulnerability Database".
Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the device password in the Nokelock app.📖 Read
via "National Vulnerability Database".
🦿 Private Internet Access VPN: A Comprehensive Review for 2023 🦿
📖 Read
via "Tech Republic".
When it comes to privacy and security, PIA VPN is among the best. Discover its features, performance, pricing and more with this in-depth review.📖 Read
via "Tech Republic".
TechRepublic
Private Internet Access VPN Review: How Good Is PIA VPN?
Private Internet Access VPN offers great privacy at a low cost, but can it keep up with top VPN providers in terms of speed and user experience?
‼ CVE-2023-43899 ‼
📖 Read
via "National Vulnerability Database".
hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5463 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in XINJE XDPPro up to 3.7.17a. It has been rated as critical. Affected by this issue is some unknown functionality in the library cfgmgr32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. VDB-241586 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5462 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in XINJE XD5E-30R-E 3.5.3b. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Modbus Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier VDB-241585 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43641 ‼
📖 Read
via "National Vulnerability Database".
libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40310 ‼
📖 Read
via "National Vulnerability Database".
SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could impact availability of SAP PowerDesigner Client.📖 Read
via "National Vulnerability Database".