‼ CVE-2023-46695 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-47204 ‼
📖 Read
via "National Vulnerability Database".
Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46595 ‼
📖 Read
via "National Vulnerability Database".
Net-NTLM leak in Fireflow A32.20 and A32.50 allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5875 ‼
📖 Read
via "National Vulnerability Database".
Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious mattermost server📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5876 ‼
📖 Read
via "National Vulnerability Database".
Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5920 ‼
📖 Read
via "National Vulnerability Database".
Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43087 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. A low privileged remote attacker could potentially exploit this vulnerability to cause information disclosure.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5917 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5916 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-244305 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43076 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerScale OneFS 8.2.x,9.0.0.x-9.5.0.x contains a denial-of-service vulnerability. A low privilege remote attacker could potentially exploit this vulnerability to cause an out of memory (OOM) condition.📖 Read
via "National Vulnerability Database".
🕴 Threat Prevention Begins With IT & Security Team Collaboration 🕴
📖 Read
via "Dark Reading".
As cyber threats evolve, so does the shared responsibility mindset that calls for IT and security to work in tandem. 📖 Read
via "Dark Reading".
Dark Reading
Threat Prevention Begins With IT & Security Team Collaboration
As cyber threats evolve, so does the shared responsibility mindset that calls for IT and security to work in tandem.
‼ CVE-2023-5860 ‼
📖 Read
via "National Vulnerability Database".
The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5918 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, was found in SourceCodester Visitor Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-244308.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46475 ‼
📖 Read
via "National Vulnerability Database".
A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43193 ‼
📖 Read
via "National Vulnerability Database".
Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS). An attacker can create a malicious link in the forum that leads to XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3164 ‼
📖 Read
via "National Vulnerability Database".
A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43336 ‼
📖 Read
via "National Vulnerability Database".
Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101.📖 Read
via "National Vulnerability Database".
🦿 G7 Countries Establish Voluntary AI Code of Conduct 🦿
📖 Read
via "Tech Republic".
The code of conduct provides guidelines for AI regulation across G7 countries and includes cybersecurity considerations and international standards.📖 Read
via "Tech Republic".
TechRepublic
G7 Countries Establish Voluntary AI Code of Conduct
The code of conduct provides guidelines for AI regulation across G7 countries and includes cybersecurity and technical standards.
🦿 UK AI Safety Summit: Global Powers Make ‘Landmark’ Pledge to AI Safety 🦿
📖 Read
via "Tech Republic".
Global leaders from 28 nations have gathered in the U.K. for an influential summit dedicated to AI regulation and safety. Here’s what you need to know.📖 Read
via "Tech Republic".
TechRepublic
UK AI Safety Summit: Global Powers Make ‘Landmark’ Pledge to AI Safety
Global leaders from 28 nations gathered in the U.K. for an influential summit dedicated to AI regulation and safety.
🕴 'Scarred Manticore' Unleashes the Most Advanced Iranian Cyber Espionage Yet 🕴
📖 Read
via "Dark Reading".
The government-backed APT's new malware framework represents a step up in Iran's cyber sophistication.📖 Read
via "Dark Reading".
Dark Reading
'Scarred Manticore' Unleashes the Most Advanced Iranian Cyber Espionage Yet
The government-backed APT's new malware framework represents a step up in Iran's cyber sophistication.
‼ CVE-2023-45336 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".