‼ CVE-2016-1203 ‼
📖 Read
via "National Vulnerability Database".
Improper file verification vulnerability in SaAT Netizen installer ver.1.2.0.424 and earlier, and SaAT Netizen ver.1.2.0.8 (Build427) and earlier allows a remote unauthenticated attacker to conduct a man-in-the-middle attack. A successful exploitation may result in a malicious file being downloaded and executed.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3007 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPPORTED WHEN ASSIGNED ** The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this vulnerability by setting arbitrary values to handle on the vulnerable device over Bluetooth.Successful exploitation of this vulnerability could allow the attacker to perform firmware update, device reboot or data manipulation on the target device.📖 Read
via "National Vulnerability Database".
🕴 'Elektra-Leak' Attackers Harvest AWS Cloud Keys in GitHub Campaign 🕴
📖 Read
via "Dark Reading".
Cyber adversaries are scanning public GitHub repositories in real-time, evading Amazon quarantine controls, and harvesting AWS keys.📖 Read
via "Dark Reading".
Dark Reading
'Elektra-Leak' Attackers Harvest AWS Cloud Keys in GitHub Campaign
Cyber adversaries are scanning public GitHub repositories in real-time, evading Amazon quarantine controls, and harvesting AWS keys.
‼ CVE-2023-5458 ‼
📖 Read
via "National Vulnerability Database".
The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4610 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** The SRCU code was added in upstream kernel v6.4-rc1 and removed before v6.4. This bug only existed in development kernels. Please see https://lore.kernel.org/all/ZTKVfoQZplpB8rki@casper.infradead.org and https://bugzilla.suse.com/show_bug.cgi?id=1215932 for more information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46979 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability via the enable parameter in the setLedCfg function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5360 ‼
📖 Read
via "National Vulnerability Database".
The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25045 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 9.9.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22518 ‼
📖 Read
via "National Vulnerability Database".
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. There is no impact to confidentiality as an attacker cannot exfiltrate any instance data.Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5211 ‼
📖 Read
via "National Vulnerability Database".
The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42658 ‼
📖 Read
via "National Vulnerability Database".
Archive, check and export commands in Chef InSpecprior to 4.56.58 and 5.22.29 allow local command execution via maliciouslycrafted profile.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25047 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 9.9.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5307 ‼
📖 Read
via "National Vulnerability Database".
The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46237 ‼
📖 Read
via "National Vulnerability Database".
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4836 ‼
📖 Read
via "National Vulnerability Database".
The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28777 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LearnDash LearnDash LMS allows SQL Injection.This issue affects LearnDash LMS: from n/a through 4.5.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24000 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/a through 2.5.7.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5229 ‼
📖 Read
via "National Vulnerability Database".
The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5098 ‼
📖 Read
via "National Vulnerability Database".
The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24410 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows SQL Injection.This issue affects Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: from n/a through 4.3.25.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46235 ‼
📖 Read
via "National Vulnerability Database".
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the logs, they would be parsed as HTML and displayed accordingly. Version 1.5.10.15 contains a patch. As a workaround, view logs from an external text editor rather than the dashboard.📖 Read
via "National Vulnerability Database".