‼ CVE-2021-46898 ‼
📖 Read
via "National Vulnerability Database".
views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46303 ‼
📖 Read
via "National Vulnerability Database".
link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2021-46897 ‼
📖 Read
via "National Vulnerability Database".
views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46306 ‼
📖 Read
via "National Vulnerability Database".
The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php device_id parameter. This occurs because another thread can be started before the trap that triggers the cleanup function. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. NOTE: this is different from CVE-2023-0861 and CVE-2023-0862, which were fixed in version 4.6.0.105.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5693 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in CodeAstro Internet Banking System 1.0 and classified as critical. This issue affects some unknown processing of the file pages_reset_pwd.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243131.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5694 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been classified as problematic. Affected is an unknown function of the file pages_system_settings.php. The manipulation of the argument sys_name with the input <ScRiPt >alert(991)</ScRiPt> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243132.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46095 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole Smooth Scroll Links [SSL] plugin <=Â 1.1.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46085 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <=Â 2.2.4 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46317 ‼
📖 Read
via "National Vulnerability Database".
Knot Resolver before 5.7.0 performs many TCP reconnections upon receiving certain nonsensical responses from servers.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5695 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file pages_reset_pwd.php. The manipulation of the argument email with the input testing%40example.com'%26%25<ScRiPt%20>alert(9860)</ScRiPt> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243133 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46089 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Lee Le @ Userback Userback plugin <=Â 1.0.13 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5696 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file pages_transfer_money.php. The manipulation of the argument account_number with the input 357146928--><ScRiPt%20>alert(9206)</ScRiPt><!-- leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-243134 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46315 ‼
📖 Read
via "National Vulnerability Database".
The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable Diffusion web UI), if Gradio authentication is enabled without secret key configuration, allows remote attackers to read any local file via /file?path= in the URL, as demonstrated by reading /proc/self/environ to discover credentials.📖 Read
via "National Vulnerability Database".
🕴 FedRAMP Rev. 5: How Cloud Service Providers Can Prepare 🕴
📖 Read
via "Dark Reading".
What cloud service providers need to know to prepare for FedRAMP Baselines Rev. 5, as documented in the new Transition Guide.📖 Read
via "Dark Reading".
Dark Reading
FedRAMP Rev. 5: How Cloud Service Providers Can Prepare
What cloud service providers need to know to prepare for FedRAMP Baselines Rev. 5, as documented in the new Transition Guide.
🦿 Penetration Testing and Scanning Policy 🦿
📖 Read
via "Tech Republic".
System or network vulnerabilities and security threats can severely impact business operations or even shutter its doors. However, these incidents can be prevented by proactively detecting potential threat opportunities. The purpose of this policy from TechRepublic Premium is to provide guidelines for appropriate penetration testing and scanning of computer systems and networks. It includes preparation, ...📖 Read
via "Tech Republic".
TechRepublic
Penetration Testing and Scanning Policy
System or network vulnerabilities and security threats can severely impact business operations or even shutter its doors. However, these incidents can be
‼ CVE-2023-43624 ‼
📖 Read
via "National Vulnerability Database".
CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4) contains an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Designer is installed may be disclosed.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-31122 ‼
📖 Read
via "National Vulnerability Database".
Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43622 ‼
📖 Read
via "National Vulnerability Database".
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.Users are recommended to upgrade to version 2.4.58, which fixes the issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45802 ‼
📖 Read
via "National Vulnerability Database".
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out.Users are recommended to upgrade to version 2.4.58, which fixes the issue.📖 Read
via "National Vulnerability Database".
♟️ NJ Man Hired Online to Firebomb, Shoot at Homes Gets 13 Years in Prison ♟️
📖 Read
via "Krebs on Security".
A 22-year-old New Jersey man has been sentenced to more than 13 years in prison for participating in a firebombing and a shooting at homes in Pennsylvania last year. Patrick McGovern-Allen was the subject of a Sept. 4, 2022 story here about the emergence of "violence-as-a-service" offerings, where random people from the Internet hire themselves out to perform a variety of local, physical attacks, including firebombing a home, "bricking" windows, slashing tires, or performing a drive-by shooting at someone's residence.📖 Read
via "Krebs on Security".
Krebs on Security
NJ Man Hired Online to Firebomb, Shoot at Homes Gets 13 Years in Prison
A 22-year-old New Jersey man has been sentenced to more than 13 years in prison for participating in a firebombing and a shooting at homes in Pennsylvania last year. Patrick McGovern-Allen was the subject of a Sept. 4, 2022 story…
🕴 Telling Small Businesses to Buy Cyber Insurance Isn't Enough 🕴
📖 Read
via "Dark Reading".
To protect themselves from threats, companies also need proactive cybersecurity.📖 Read
via "Dark Reading".
Dark Reading
Telling Small Businesses to Buy Cyber Insurance Isn't Enough
To protect themselves from threats, companies also need proactive cybersecurity.