‼ CVE-2023-5918 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, was found in SourceCodester Visitor Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-244308.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46475 ‼
📖 Read
via "National Vulnerability Database".
A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43193 ‼
📖 Read
via "National Vulnerability Database".
Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS). An attacker can create a malicious link in the forum that leads to XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3164 ‼
📖 Read
via "National Vulnerability Database".
A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43336 ‼
📖 Read
via "National Vulnerability Database".
Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101.📖 Read
via "National Vulnerability Database".
🦿 G7 Countries Establish Voluntary AI Code of Conduct 🦿
📖 Read
via "Tech Republic".
The code of conduct provides guidelines for AI regulation across G7 countries and includes cybersecurity considerations and international standards.📖 Read
via "Tech Republic".
TechRepublic
G7 Countries Establish Voluntary AI Code of Conduct
The code of conduct provides guidelines for AI regulation across G7 countries and includes cybersecurity and technical standards.
🦿 UK AI Safety Summit: Global Powers Make ‘Landmark’ Pledge to AI Safety 🦿
📖 Read
via "Tech Republic".
Global leaders from 28 nations have gathered in the U.K. for an influential summit dedicated to AI regulation and safety. Here’s what you need to know.📖 Read
via "Tech Republic".
TechRepublic
UK AI Safety Summit: Global Powers Make ‘Landmark’ Pledge to AI Safety
Global leaders from 28 nations gathered in the U.K. for an influential summit dedicated to AI regulation and safety.
🕴 'Scarred Manticore' Unleashes the Most Advanced Iranian Cyber Espionage Yet 🕴
📖 Read
via "Dark Reading".
The government-backed APT's new malware framework represents a step up in Iran's cyber sophistication.📖 Read
via "Dark Reading".
Dark Reading
'Scarred Manticore' Unleashes the Most Advanced Iranian Cyber Espionage Yet
The government-backed APT's new malware framework represents a step up in Iran's cyber sophistication.
‼ CVE-2023-45336 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45345 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_deleted' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45346 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_role' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45342 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/register-router.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45339 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'type' parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26452 ‼
📖 Read
via "National Vulnerability Database".
Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29044 ‼
📖 Read
via "National Vulnerability Database".
Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now get escaped to avoid code execution. No publicly available exploits are known.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45332 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'deleted' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29047 ‼
📖 Read
via "National Vulnerability Database".
Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible to the imageconverter SQL user account. None No publicly available exploits are known.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45334 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'status' parameter of the routers/edit-orders.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45340 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/details-router.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45337 ‼
📖 Read
via "National Vulnerability Database".
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26455 ‼
📖 Read
via "National Vulnerability Database".
RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.📖 Read
via "National Vulnerability Database".