PT-2023-24582

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.30 Liferay DXP 7.4 before update 31 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL in IFrame type Remote...

Unleash Spring apps in a flex environment with Azure Spring Apps Consumption and Dedicated plans

In March, we introduced the Consumption pricing plan for Azure Spring Apps allowing you to start from zero and scale to zero vCPU. Today, we are thrilled to announce the public preview of the Standard Dedicated plan! The Standard Dedicated plan provides a fully managed, dedicated environment for...

CVE-2023-33294

An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctwebserver binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns...

CVE-2023-33293

An issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local web server on .localhost with subdomains for each installed applications, e.g., myapp.localhost. An attacker can make fetch requests to api-deamon to determine if a given app is installed and read th...

CVE-2023-33294

An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctwebserver binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns...

CVE-2023-23890

Cross-Site Request Forgery CSRF vulnerability in LJ Apps WP Airbnb Review Slider plugin = 3.2 versions...

CVE-2023-23890

Cross-Site Request Forgery CSRF vulnerability in LJ Apps WP Airbnb Review Slider plugin = 3.2 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in LJ Apps WP Airbnb Review Slider plugin = 3.2 versions...

CVE-2023-23890

CVE-2023-23890 affects the WordPress plugin WP Airbnb Review Slider (LJ Apps) versioned up to 3.2. The vulnerability is a Cross-Site Request Forgery (CSRF) that can lead to reviews being removed; Patch details indicate the issue is exploitable by an unauthenticated attacker and is fixed in versio...

Apple Thwarts $2 Billion in App Store Fraud, Rejects 1.7 Million App Submissions

Apple has announced that it prevented over $2 billion in potentially fraudulent transactions and rejected roughly 1.7 million app submissions for privacy and security violations in 2022. The computing giant said it terminated 428,000 developer accounts for potential fraudulent activity, blocked...

Apple Thwarts $2 Billion in App Store Fraud, Rejects 1.7 Million App Submissions

Apple has announced that it prevented over $2 billion in potentially fraudulent transactions and rejected roughly 1.7 million app submissions for privacy and security violations in 2022. The computing giant said it terminated 428,000 developer accounts for potential fraudulent activity, blocked...

Apple macOS Ventura 安全漏洞

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura version 13.4, which arises from the possibility that rights and privacy permissions granted to this application could be used by malicious applications...

Facebook Hermes 资源管理错误漏洞

Facebook Hermes is a JavaScript engine from Facebook Inc. in the United States. The engine is targeted at React Native applications to improve the performance of mobile client application apps, but not for server-side infrastructures such as browsers & Node.js. A security vulnerability exists in...

OilAlpha: Emerging Houthi-linked Cyber Threat Targets Arabian Android Users

A hacking group dubbed OilAlpha with suspected ties to Yemen's Houthi movement has been linked to a cyber espionage campaign targeting development, humanitarian, media, and non-governmental organizations in the Arabian peninsula. "OilAlpha used encrypted chat messengers like WhatsApp to launch...

CVE-2023-21116

In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages allows a perpetrator to perform a service failure.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise programs exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to perform service denial-of-service attacks...

Vulnerability of Microsoft Excel, Microsoft Office, Microsoft 365 Apps for Enterprise, Microsoft SharePoint, and Microsoft Office Online Server packages, allowing a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Excel, Microsoft Office, Microsoft 365 Apps for Enterprise, Microsoft SharePoint, and Microsoft Office Online Server relates to the execution of operations outside of the buffer in memory. Exploitation of this vulnerability can allow an attacker to execute arbitrary...

CVE-2023-21116

In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for...

PT-2023-17908 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-11 through Android-13 Description: A logic error in the code of InstallPackageHelper.java, specifically in the verifyReplacingVersionCode function, allows for a possible downgrade of system apps below the system image...

The vulnerability of the App-V software service for virtualizing and delivering Citrix Virtual Apps and Desktops (formerly XenApp and XenDesktop), operating systems Windows, allows a malicious individual to escalate their privileges and execute arbitrary commands.

The vulnerability of the App-V software service for virtualizing and delivering Citrix Virtual Apps and Desktops formerly XenApp and XenDesktop on Windows operating systems is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiti...