‼ CVE-2022-48182 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44392 ‼
📖 Read
via "National Vulnerability Database".
Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the Kubernetes `ConfigMap` resources prefixed with `test-result` and `run-result` to cache Garden test and run results. These `ConfigMaps` are stored either in the `garden-system` namespace or the configured user namespace. When a user invokes the command `garden test` or `garden run` objects stored in the `ConfigMap` are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the `ConfigMap`, which can trigger a remote code execution on the users machine when cryo deserializes the object. In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a `garden test` or `garden run` which has previously cached results. The issue has been patched in Garden versions `0.13.17` (Bonsai) and `0.12.65` (Acorn). Only Garden versions prior to these are vulnerable. No known workarounds are available.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5461 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Handler. The manipulation leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241584. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44812 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43271 ‼
📖 Read
via "National Vulnerability Database".
Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36228 ‼
📖 Read
via "National Vulnerability Database".
Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the device password in the Nokelock app.📖 Read
via "National Vulnerability Database".
🦿 Private Internet Access VPN: A Comprehensive Review for 2023 🦿
📖 Read
via "Tech Republic".
When it comes to privacy and security, PIA VPN is among the best. Discover its features, performance, pricing and more with this in-depth review.📖 Read
via "Tech Republic".
TechRepublic
Private Internet Access VPN Review: How Good Is PIA VPN?
Private Internet Access VPN offers great privacy at a low cost, but can it keep up with top VPN providers in terms of speed and user experience?
‼ CVE-2023-43899 ‼
📖 Read
via "National Vulnerability Database".
hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5463 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in XINJE XDPPro up to 3.7.17a. It has been rated as critical. Affected by this issue is some unknown functionality in the library cfgmgr32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. VDB-241586 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5462 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in XINJE XD5E-30R-E 3.5.3b. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Modbus Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier VDB-241585 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43641 ‼
📖 Read
via "National Vulnerability Database".
libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40310 ‼
📖 Read
via "National Vulnerability Database".
SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could impact availability of SAP PowerDesigner Client.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42474 ‼
📖 Read
via "National Vulnerability Database".
SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44826 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18336 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability found in Typora v.0.9.65 allows a remote attacker to obtain sensitive information via the PDF file exporting function.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-42477 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42475 ‼
📖 Read
via "National Vulnerability Database".
The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44848 ‼
📖 Read
via "National Vulnerability Database".
An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_template.php component.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41850 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Morris Bryant, Ruben Sargsyan Outbound Link Manager plugin <=Â 1.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44259 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Mediavine Mediavine Control Panel plugin <=Â 2.10.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41854 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Softaculous Ltd. WpCentral plugin <=Â 1.5.7 versions.📖 Read
via "National Vulnerability Database".