‼ CVE-2023-5852 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5850 ‼
📖 Read
via "National Vulnerability Database".
Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5855 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Reading Mode in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-20063 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the inter-device communication mechanisms between devices that are running Cisco Firepower Threat Defense (FTD) Software and devices that are running Cisco Firepower Management (FMC) Software could allow an authenticated, local attacker to execute arbitrary commands with root permissions on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by accessing the expert mode of an affected device and submitting specific commands to a connected system. A successful exploit could allow the attacker to execute arbitrary code in the context of an FMC device if the attacker has administrative privileges on an associated FTD device. Alternatively, a successful exploit could allow the attacker to execute arbitrary code in the context of an FTD device if the attacker has administrative privileges on an associated FMC device.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5857 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially execute arbitrary code via a malicious file. (Chromium security severity: Medium)📖 Read
via "National Vulnerability Database".
‼ CVE-2023-20070 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the TLS 1.3 implementation of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This vulnerability is due to a logic error in how memory allocations are handled during a TLS 1.3 session. Under specific, time-based constraints, an attacker could exploit this vulnerability by sending a crafted TLS 1.3 message sequence through an affected device. A successful exploit could allow the attacker to cause the Snort 3 detection engine to reload, resulting in a denial of service (DoS) condition. While the Snort detection engine reloads, packets going through the FTD device that are sent to the Snort detection engine will be dropped. The Snort detection engine will restart automatically. No manual intervention is required.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-20071 ‼
📖 Read
via "National Vulnerability Database".
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a flaw in the FTP module of the Snort detection engine. An attacker could exploit this vulnerability by sending crafted FTP traffic through an affected device. A successful exploit could allow the attacker to bypass FTP inspection and deliver a malicious payload.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-20042 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an implementation error within the SSL/TLS session handling process that can prevent the release of a session handler under specific conditions. An attacker could exploit this vulnerability by sending crafted SSL/TLS traffic to an affected device, increasing the probability of session handler leaks. A successful exploit could allow the attacker to eventually deplete the available session handler pool, preventing new sessions from being established and causing a DoS condition.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-20246 ‼
📖 Read
via "National Vulnerability Database".
Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a logic error that occurs when the access control policies are being populated. An attacker could exploit this vulnerability by establishing a connection to an affected device. A successful exploit could allow the attacker to bypass configured access control rules on the affected system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5480 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)📖 Read
via "National Vulnerability Database".
🕴 Global AI Cybersecurity Agreement Signed At Turing's Bletchley Park 🕴
📖 Read
via "Dark Reading".
Dozens of countries commit to collaborate on artificial intelligence cybersecurity, fittingly at the British home of the WWII codebreakers. 📖 Read
via "Dark Reading".
Dark Reading
Global AI Cybersecurity Agreement Signed At Turing's Bletchley Park
Dozens of countries commit to collaborate on artificial intelligence cybersecurity, fittingly at the British home of the WWII codebreakers.
‼ CVE-2023-46428 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1193 ‼
📖 Read
via "National Vulnerability Database".
A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed work.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1192 ‼
📖 Read
via "National Vulnerability Database".
A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-46724 ‼
📖 Read
via "National Vulnerability Database".
Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3397 ‼
📖 Read
via "National Vulnerability Database".
A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attacker with normal user privileges to crash the system or leak internal kernel information.📖 Read
via "National Vulnerability Database".
🕴 More Than 100 Vulns in Microsoft 365 Tied to SketchUp 3D Library 🕴
📖 Read
via "Dark Reading".
While Microsoft patched the issues in June, support for SketchUp appears to remain disabled in Microsoft 365.📖 Read
via "Dark Reading".
Darkreading
More Than 100 Vulns in Microsoft 365 Tied to SketchUp 3D Library
While Microsoft patched the issues in June, support for SketchUp appears to remain disabled in Microsoft 365.
‼ CVE-2023-45202 ‼
📖 Read
via "National Vulnerability Database".
Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the feed.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46448 ‼
📖 Read
via "National Vulnerability Database".
Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45203 ‼
📖 Read
via "National Vulnerability Database".
Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the login.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44025 ‼
📖 Read
via "National Vulnerability Database".
SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the getrulebyid function in the AddifyfreegiftsModel.php component.📖 Read
via "National Vulnerability Database".