CVE-2023-29836

Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions EUCS v.1.0 allows a remote attacker to execute arbitrary code via the Username parameter of the eucsAdmin login form...

CVE-2023-29836

Exelysis EUCS v1.0 has a cross-site scripting vulnerability that can allow a remote attacker to gain privileges via the eucsAdmin login URL path. Related entries CVE-2023-29836 and CVE-2023-29837 describe the same issue. Some sources (PT-2023-22437) provide temporary mitigations (restrict access ...

Exelysis Unified Communication Solutions 跨站脚本漏洞

Exelysis Unified Communication Solutions EUCS is a unified communication solution from Exelysis. A security vulnerability exists in Exelysis Unified Communication Solutions EUCS version 1.0. An attacker could exploit the vulnerability to execute arbitrary code via the Username parameter of the...

Malicious code in tucan-x (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 69bdf61be1b4579f5016adcacef468a263b798b77b87d354e90900d4cb4474b8 The OpenSSF Package Analysis project identified 'tucan-x' @ 0.0.2 pypi as malicious. It is considered malicious because: - The package...

Iranian Hackers Launch Sophisticated Attacks Targeting Israel with PowerLess Backdoor

An Iranian nation-state threat actor has been linked to a new wave of phishing attacks targeting Israel that's designed to deploy an updated version of a Windows backdoor called PowerLess. Cybersecurity firm Check Point is tracking the activity cluster under its mythical creature handle Educated...

MAL-2023-1340 Malicious code in w_sox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dba7dc82566307dfb355c21af9d35d4234490e034f4c80280a555a8a7ce5ef9e The OpenSSF Package Analysis project identified 'wsox' @ 7.1.2 npm as malicious. It is considered malicious because: - The package communicates...

ViperSoftX Updates Encryption, Steals Data

We observed cryptocurrency and information stealer ViperSoftX evading initial loader detection and making its lure more believable by making the initial package loader via cracks, keygens, activators, and packers non-malicious. We also noted more sophisticated encryption and basic anti-analysis...

CVE-2023-21086

In isToggleable of SecureNfcEnabler.java and SecureNfcPreferenceController.java, there is a possible way to enable NFC from a secondary account due to a permissions bypass. This could lead to local escalation of privilege from the Guest account with no additional execution privileges needed. User...

CVE-2022-38125

Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager FTP Agent modules allows Exploiting Trust in Client...

CVE-2022-38125

Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager FTP Agent modules allows Exploiting Trust in Client...

CVE-2022-38125 FTP Agent forwards traffic on inactive ports to LinkManager

Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager FTP Agent modules allows Exploiting Trust in Client...

CVE-2022-38125

CVE-2022-38125 affects Secomea SiteManager, specifically the FTP Agent modules. The root cause is Improper Restriction of Communication Channel to Intended Endpoints, enabling exploitation of trust in the client. The NVD entry lists a CVSS v3.1 base score of 5.5 (Medium) with Local attack vector,...

CVE-2022-38125 FTP Agent forwards traffic on inactive ports to LinkManager

Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager FTP Agent modules allows Exploiting Trust in Client...

MAL-2023-1328 Malicious code in update.electronjs.org (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 570da49a43c941cec1292b434882e33fa9b0d622894934efe87b8cf494184da6 The OpenSSF Package Analysis project identified 'update.electronjs.org' @ 99.9.9 npm as malicious. It is considered malicious because: - The...

[SECURITY] Fedora 38 Update: openssh-9.0p1-15.fc38

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

Secomea SiteManager 安全漏洞

Secomea SiteManager is a software application from Secomea, Denmark. It provides a remote maintenance function for industrial equipment. A security vulnerability exists in Secomea SiteManager that stems from the presence of a communication channel that improperly restricts the intended endpoints...

Vulnerabilities fixed in Oracle Communications

Vulnerabilities have been fixed in Oracle Communications. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Bypassing authentication Remote code execution User rights Access to system data...

[SECURITY] Fedora 37 Update: openssh-8.8p1-10.fc37

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

CVE-2023-28971

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the timescaledb feature of Juniper Networks Paragon Active Assurance PAA Formerly Netrounds allows an attacker to bypass existing firewall rules and limitations used to restrict internal communcations. The Tes...

Design/Logic Flaw

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the timescaledb feature of Juniper Networks Paragon Active Assurance PAA Formerly Netrounds allows an attacker to bypass existing firewall rules and limitations used to restrict internal communcations. The Tes...