‼ CVE-2023-45798 ‼
📖 Read
via "National Vulnerability Database".
In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution.📖 Read
via "National Vulnerability Database".
🦿 Microsoft Exposes Octo Tempest, One of the Most Dangerous Financial Threat Actors to Date 🦿
📖 Read
via "Tech Republic".
Microsoft exposes Octo Tempest, an English-speaking threat actor that runs extortion, encryption and destruction campaigns at a wide variety of industries. Protect your company from Octo Tempest with these tips.📖 Read
via "Tech Republic".
TechRepublic
Microsoft Exposes Octo Tempest, One of the Most Dangerous Financial Threat Actors to Date
Microsoft exposes Octo Tempest, a threat actor that runs extortion, encryption and destruction campaigns at a wide variety of industries.
🕴 UAE Bolsters Cyber Future With US Treasury Partnership, Collaborations 🕴
📖 Read
via "Dark Reading".
A determination to be taken seriously as a cyber player sees the United Arab Emirates announce a series of collaborations.📖 Read
via "Dark Reading".
Dark Reading
UAE Bolsters Cyber Future With US Treasury Partnership, Collaborations
A determination to be taken seriously as a cyber player sees the United Arab Emirates announce a series of collaborations.
‼ CVE-2023-21355 ‼
📖 Read
via "National Vulnerability Database".
In libaudioclient, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21352 ‼
📖 Read
via "National Vulnerability Database".
In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21323 ‼
📖 Read
via "National Vulnerability Database".
In Activity Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21364 ‼
📖 Read
via "National Vulnerability Database".
In ContactsProvider, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21367 ‼
📖 Read
via "National Vulnerability Database".
In Scudo, there is a possible way to exploit certain heap OOB read/write issues due to an insecure implementation/design. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-47090 ‼
📖 Read
via "National Vulnerability Database".
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21340 ‼
📖 Read
via "National Vulnerability Database".
In Telecomm, there is a possible way to get the call state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21371 ‼
📖 Read
via "National Vulnerability Database".
In Secure Element, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21344 ‼
📖 Read
via "National Vulnerability Database".
In Job Scheduler, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21369 ‼
📖 Read
via "National Vulnerability Database".
In Usage Access, there is a possible way to display a Settings usage access restriction toggle screen due to a permissions bypass. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21351 ‼
📖 Read
via "National Vulnerability Database".
In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21360 ‼
📖 Read
via "National Vulnerability Database".
In Bluetooth, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21365 ‼
📖 Read
via "National Vulnerability Database".
In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21368 ‼
📖 Read
via "National Vulnerability Database".
In Audio, there is a possible out of bounds read due to missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21362 ‼
📖 Read
via "National Vulnerability Database".
In Usage, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21361 ‼
📖 Read
via "National Vulnerability Database".
In Bluetooth, there is a possibility of code-execution due to a use after free. This could lead to paired device escalation of privilege in the privileged Bluetooth process with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36920 ‼
📖 Read
via "National Vulnerability Database".
In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disclosure or modification of information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21356 ‼
📖 Read
via "National Vulnerability Database".
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".