πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2023-5497 β€Ό

A vulnerability classified as critical has been found in Tongda OA 2017 11.10. Affected is an unknown function of the file general/hr/salary/welfare_manage/delete.php. The manipulation of the argument WELFARE_ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-241650 is the identifier assigned to this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-36703 β€Ό

DHCP Server Service Denial of Service Vulnerability

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-45648 β€Ό

Improper Input Validation vulnerability in Apache Tomcat.TomcatΓ‚ from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ New One-Click Exploit Is a Supply Chain Risk for Linux OSes πŸ•΄

An overlooked library contains a vulnerability that could enable full remote takeover simply by clicking a link.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Microsoft Patch Tuesday Haunted by Zero-Days, Wormable Bug πŸ•΄

October's CVE update is here. Here's which security vulnerabilities to patch now to exorcise your Microsoft systems demons.

πŸ“– Read

via "Dark Reading".
β™ŸοΈ Patch Tuesday, October 2023 Edition β™ŸοΈ

Microsoft today issued security updates for more than 100 newly-discovered vulnerabilities in its Windows operating system and related software, including four flaws that are already being exploited. In addition, Apple recently released emergency updates to quash a pair of zero-day bugs in iOS.

πŸ“– Read

via "Krebs on Security".
❀1
β€Ό CVE-2023-26220 β€Ό

The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-36127 β€Ό

User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-36126 β€Ό

There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ A Frontline Report of Chinese Threat Actor Tactics and Techniques πŸ•΄

Threat intel experts see a reduced focus on desktop malware as threat groups prioritize passwords and tokens that let them access the same systems as remote workers.

πŸ“– Read

via "Dark Reading".
πŸ‘1
β€Ό CVE-2023-5511 β€Ό

Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.

πŸ“– Read

via "National Vulnerability Database".
❀1
β€Ό CVE-2023-44689 β€Ό

e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the user may become a victim of a phishing attack.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-45194 β€Ό

Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier allows a network-adjacent unauthenticated attacker to intercept wireless LAN communication, when the affected product performs the communication without changing the pre-shared key from the factory-default configuration.

πŸ“– Read

via "National Vulnerability Database".
🦿 F5 Warns Australian IT of Social Engineering Risk Escalation Due to Generative AI 🦿

F5 says an artificial intelligence war could start between generative AI-toting bad actors and enterprises guarding data with AI. Australian IT teams will be caught in the crossfire.

πŸ“– Read

via "Tech Republic".
❀1
β€Ό CVE-2023-26318 β€Ό

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-26320 β€Ό

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-44758 β€Ό

BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly authorized.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-26319 β€Ό

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-37536 β€Ό

An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-42138 β€Ό

Out-of-bounds read vulnerability exists in KV STUDIO Ver. 11.62 and earlier and KV REPLAY VIEWER Ver. 2.62 and earlier. If this vulnerability is exploited, information may be disclosed or arbitrary code may be executed by having a user of KV STUDIO PLAYER open a specially crafted file.

πŸ“– Read

via "National Vulnerability Database".