‼ CVE-2023-4592 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload through the /tools/webinterface/index.php parameter and retrieve the cookie session details of an authenticated user, resulting in a session hijacking.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46808 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems ARMember armember-membership allows SQL Injection.This issue affects ARMember: from n/a through 3.4.11.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25960 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zendrop Zendrop – Global Dropshipping zendrop-dropshipping-and-fulfillment allows SQL Injection.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46859 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-34383 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP Project Manager wedevs-project-manager allows SQL Injection.This issue affects WP Project Manager: from n/a through 2.6.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41652 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 10.6.6.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26015 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Chris Richardson MapPress Maps for WordPress mappress-google-maps-for-wordpress allows SQL Injection.This issue affects MapPress Maps for WordPress: from n/a through 2.85.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46947 ‼
📖 Read
via "National Vulnerability Database".
Subrion 4.2.1 has a remote command execution vulnerability in the backend.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47426 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Neshan Maps Platform Neshan Maps neshan-maps allows SQL Injection.This issue affects Neshan Maps: from n/a through 1.1.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-45805 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paytm Paytm Payment Gateway paytm-payments allows SQL Injection.This issue affects Paytm Payment Gateway: from n/a through 2.7.3.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-5707 ‼
📖 Read
via "National Vulnerability Database".
The SEO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slider' shortcode and post meta in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3961 ‼
📖 Read
via "National Vulnerability Database".
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5945 ‼
📖 Read
via "National Vulnerability Database".
The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the responsive_video_gallery_with_lightbox_video_management_func() function. This makes it possible for unauthenticated attackers to delete videos hosted from the video slider via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47588 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery simple-photo-gallery allows SQL Injection.This issue affects Simple Photo Gallery: from n/a through v1.8.1.📖 Read
via "National Vulnerability Database".
🕴 Spyware Designed for Telegram Mods Also Targets WhatsApp Add-Ons 🕴
📖 Read
via "Dark Reading".
Researchers discovered spyware designed to steal from Android devices and from Telegram mods can also reach WhatsApp users.📖 Read
via "Dark Reading".
Dark Reading
Spyware Designed for Telegram Mods Also Targets WhatsApp Add-Ons
Researchers discovered spyware designed to steal from Android devices and from Telegram mods can also reach WhatsApp users.
‼ CVE-2023-5946 ‼
📖 Read
via "National Vulnerability Database".
The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_group_id' parameter in version 6.0.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5088 ‼
📖 Read
via "National Vulnerability Database".
A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.📖 Read
via "National Vulnerability Database".
🦿 What Is a VPN? Definition, How It Works, and More 🦿
📖 Read
via "Tech Republic".
A VPN (virtual private network) encrypts your internet traffic and protects your online privacy. Find out how it works and why you should use it.📖 Read
via "Tech Republic".
TechRepublic
What Is a VPN? Definition, How It Works, and More
A VPN (virtual private network) encrypts your internet traffic and protects your online privacy. Find out how it works and why you should use it.
🕴 Somebody Just Killed the Mozi Botnet 🕴
📖 Read
via "Dark Reading".
The once great botnet was nearly entirely eliminated in August. Why, who did it, and what comes next remain unclear.📖 Read
via "Dark Reading".
Dark Reading
Somebody Just Killed the Mozi Botnet
The once great botnet was nearly entirely eliminated in August. Why, who did it, and what comes next remain unclear.
🕴 'KandyKorn' macOS Malware Lures Crypto Engineers 🕴
📖 Read
via "Dark Reading".
Posing as fellow engineers, the North Korean state-sponsored cybercrime group Lazarus tricked crypto-exchange developers into downloading the hard-to-detect malware.📖 Read
via "Dark Reading".
Dark Reading
'KandyKorn' macOS Malware Lures Crypto Engineers
Posing as fellow engineers, the North Korean state-sponsored cybercrime group Lazarus tricked crypto-exchange developers into downloading the hard-to-detect malware.
🕴 Okta Customer Support Breach Exposed Data on 134 Companies 🕴
📖 Read
via "Dark Reading".
1Password, BeyondTrust, and Cloudflare were among five customers directly targeted with stolen Okta session tokens, the company's CSO says. 📖 Read
via "Dark Reading".
Dark Reading
Okta Customer Support Breach Exposed Data on 134 Companies
1Password, BeyondTrust, and Cloudflare were among five customers directly targeted with stolen Okta session tokens, the company's CSO says.