‼ CVE-2023-5916 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-244305 was assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43076 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerScale OneFS 8.2.x,9.0.0.x-9.5.0.x contains a denial-of-service vulnerability. A low privilege remote attacker could potentially exploit this vulnerability to cause an out of memory (OOM) condition.📖 Read
via "National Vulnerability Database".
🕴 Threat Prevention Begins With IT & Security Team Collaboration 🕴
📖 Read
via "Dark Reading".
As cyber threats evolve, so does the shared responsibility mindset that calls for IT and security to work in tandem. 📖 Read
via "Dark Reading".
Dark Reading
Threat Prevention Begins With IT & Security Team Collaboration
As cyber threats evolve, so does the shared responsibility mindset that calls for IT and security to work in tandem.
‼ CVE-2023-5860 ‼
📖 Read
via "National Vulnerability Database".
The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5918 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, was found in SourceCodester Visitor Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-244308.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46475 ‼
📖 Read
via "National Vulnerability Database".
A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43193 ‼
📖 Read
via "National Vulnerability Database".
Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS). An attacker can create a malicious link in the forum that leads to XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3164 ‼
📖 Read
via "National Vulnerability Database".
A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43336 ‼
📖 Read
via "National Vulnerability Database".
Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101.📖 Read
via "National Vulnerability Database".
🦿 G7 Countries Establish Voluntary AI Code of Conduct 🦿
📖 Read
via "Tech Republic".
The code of conduct provides guidelines for AI regulation across G7 countries and includes cybersecurity considerations and international standards.📖 Read
via "Tech Republic".
TechRepublic
G7 Countries Establish Voluntary AI Code of Conduct
The code of conduct provides guidelines for AI regulation across G7 countries and includes cybersecurity and technical standards.
🦿 UK AI Safety Summit: Global Powers Make ‘Landmark’ Pledge to AI Safety 🦿
📖 Read
via "Tech Republic".
Global leaders from 28 nations have gathered in the U.K. for an influential summit dedicated to AI regulation and safety. Here’s what you need to know.📖 Read
via "Tech Republic".
TechRepublic
UK AI Safety Summit: Global Powers Make ‘Landmark’ Pledge to AI Safety
Global leaders from 28 nations gathered in the U.K. for an influential summit dedicated to AI regulation and safety.
🕴 'Scarred Manticore' Unleashes the Most Advanced Iranian Cyber Espionage Yet 🕴
📖 Read
via "Dark Reading".
The government-backed APT's new malware framework represents a step up in Iran's cyber sophistication.📖 Read
via "Dark Reading".
Dark Reading
'Scarred Manticore' Unleashes the Most Advanced Iranian Cyber Espionage Yet
The government-backed APT's new malware framework represents a step up in Iran's cyber sophistication.
‼ CVE-2023-45336 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45345 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_deleted' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45346 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_role' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45342 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/register-router.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45339 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'type' parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26452 ‼
📖 Read
via "National Vulnerability Database".
Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29044 ‼
📖 Read
via "National Vulnerability Database".
Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now get escaped to avoid code execution. No publicly available exploits are known.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45332 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'deleted' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29047 ‼
📖 Read
via "National Vulnerability Database".
Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible to the imageconverter SQL user account. None No publicly available exploits are known.📖 Read
via "National Vulnerability Database".