🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.1K subscribers
88.4K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.1K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-5681 ‼

A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_addr_fwresource_ip.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243057 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

📖 Read

via "National Vulnerability Database".
327 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-37824 ‼

Sitolog sitologapplicationconnect v7.8.a and before was discovered to contain a SQL injection vulnerability via the component /activate_hook.php.

📖 Read

via "National Vulnerability Database".
335 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-43353 ‼

Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu component.

📖 Read

via "National Vulnerability Database".
321 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-32785 ‼

In Langchain through 0.0.155, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.

📖 Read

via "National Vulnerability Database".
327 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-38191 ‼

An issue was discovered in SuperWebMailer 9.00.0.01710. It allows spamtest_external.php XSS via a crafted filename.

📖 Read

via "National Vulnerability Database".
294 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-43354 ‼

Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component.

📖 Read

via "National Vulnerability Database".
334 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-43357 ‼

Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component.

📖 Read

via "National Vulnerability Database".
343 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-32786 ‼

In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

📖 Read

via "National Vulnerability Database".
374 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-43356 ‼

Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component.

📖 Read

via "National Vulnerability Database".
501 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-43346 ‼

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Backend - Dashboard parameter in the Languages Menu component.

📖 Read

via "National Vulnerability Database".
538 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-43355 ‼

Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters in the My Preferences - Add user component.

📖 Read

via "National Vulnerability Database".
👍2
524 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-5205 ‼

The Add Custom Body Class plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_custom_body_class' value in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

📖 Read

via "National Vulnerability Database".
440 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-5684 ‼

A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243061 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

📖 Read

via "National Vulnerability Database".
430 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4635 ‼

The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

📖 Read

via "National Vulnerability Database".
385 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-5683 ‼

A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btn_file_renew leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

📖 Read

via "National Vulnerability Database".
483 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4939 ‼

The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication token for the /wp-json/salesmanago/v1/callbackApiV3 API endpoint which is simply a SHA1 hash of the site URL and client ID found in the page source of the website. This makes it possible for unauthenticated attackers to inject arbitrary content into the log files, and when combined with another vulnerability this could have significant consequences.

📖 Read

via "National Vulnerability Database".
544 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-46055 ‼

An issue in ThingNario Photon v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the ping function to the "thingnario Logger Maintenance Webpage" endpoint.

📖 Read

via "National Vulnerability Database".
🔥1
605 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-46054 ‼

Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_footer parameter in the admin/settings/save.php component.

📖 Read

via "National Vulnerability Database".
699 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-46067 ‼

Cross-Site Request Forgery (CSRF) vulnerability in Qwerty23 Rocket Font plugin <= 1.2.3 versions.

📖 Read

via "National Vulnerability Database".
637 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-46078 ‼

Cross-Site Request Forgery (CSRF) vulnerability in PluginEver WC Serial Numbers plugin <= 1.6.3 versions.

📖 Read

via "National Vulnerability Database".
635 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-46298 ‼

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.

📖 Read

via "National Vulnerability Database".
595 views