🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.1K subscribers
88.4K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.1K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-44569 ‼

A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.

📖 Read

via "National Vulnerability Database".
298 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-47233 ‼

The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access, this "could be exploited in a real world scenario." This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.

📖 Read

via "National Vulnerability Database".
445 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-47234 ‼

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path attributes).

📖 Read

via "National Vulnerability Database".
446 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-41725 ‼

Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability

📖 Read

via "National Vulnerability Database".
426 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-41726 ‼

Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability

📖 Read

via "National Vulnerability Database".
441 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2022-3172 ‼

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.

📖 Read

via "National Vulnerability Database".
484 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-36677 ‼

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager allows SQL Injection.This issue affects SP Project & Document Manager: from n/a through 4.67.

📖 Read

via "National Vulnerability Database".
587 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-45189 ‼

A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result in access to client vault credentials. This difficult to exploit vulnerability could allow a low privileged attacker to programmatically access client vault credentials. IBM X-Force ID: 268752.

📖 Read

via "National Vulnerability Database".
718 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-35910 ‼

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nucleus_genius Quasar form free – Contact Form Builder for WordPress allows SQL Injection.This issue affects Quasar form free – Contact Form Builder for WordPress: from n/a through 6.0.

📖 Read

via "National Vulnerability Database".
784 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-46381 ‼

LOYTEC LINX-212 firmware 6.2.4 and LVIS-3ME12-A1 firmware 6.2.2 and LIOB-586 firmware 6.2.3 devices lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/ URI. An unauthenticated attacker can edit any project (or create a new project) and control its GUI.

📖 Read

via "National Vulnerability Database".
696 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-46380 ‼

LOYTEC LINX-212 firmware 6.2.4 and LVIS-3ME12-A1 firmware 6.2.2 and LIOB-586 firmware 6.2.3 devices send password-change requests via cleartext HTTP.

📖 Read

via "National Vulnerability Database".
713 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-40922 ‼

kerawen before v2.5.1 was discovered to contain a SQL injection vulnerability via the ocs_id_cart parameter at KerawenDeliveryModuleFrontController::initContent().

📖 Read

via "National Vulnerability Database".
743 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-46382 ‼

LOYTEC LINX-212 firmware 6.2.4 and LVIS-3ME12-A1 firmware 6.2.2 and LIOB-586 firmware 6.2.3 devices use cleartext HTTP for login.

📖 Read

via "National Vulnerability Database".
740 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-46963 ‼

An issue in Beijing Yunfan Internet Technology Co., Ltd, Yunfan Learning Examination System v.6.5 allows a remote attacker to obtain sensitive information via the password parameter in the login function.

📖 Read

via "National Vulnerability Database".
❤1
793 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2018-25092 ‼

A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Command Mention Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The patch is named cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244483.

📖 Read

via "National Vulnerability Database".
686 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2017-20187 ‼

** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to injection. Upgrading to version 0.3.1 is able to address this issue. The patch is identified as 500d340e1f6421007413cc08a8383475221c2604. It is recommended to upgrade the affected component. VDB-244482 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

📖 Read

via "National Vulnerability Database".
679 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-32840 ‼

In modem CCCI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction may be also needed for exploitation Patch ID: MOLY01138425; Issue ID: MOLY01138425 (MSV-862).

📖 Read

via "National Vulnerability Database".
449 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-32834 ‼

In secmem, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08161762; Issue ID: ALPS08161762.

📖 Read

via "National Vulnerability Database".
404 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-4625 ‼

Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login.

📖 Read

via "National Vulnerability Database".
371 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-32825 ‼

In bluethooth service, there is a possible out of bounds reads due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07884130; Issue ID: ALPS07884130.

📖 Read

via "National Vulnerability Database".
297 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-32818 ‼

In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08163896 & ALPS08013430; Issue ID: ALPS07867715.

📖 Read

via "National Vulnerability Database".
304 views