KB5023791: Servicing stack update for Windows Server 2012: March 14, 2023

KB5023791: Servicing stack update for Windows Server 2012: March 14, 2023 IMPORTANT For Windows Server 2012, the end of support EOS date is October 10, 2023. Extended Security Updates ESUs will be available for purchase no later than October 2022, but available for installation after the EOS date...

D-Link DIR-820L Devices Multiple Vulnerabilities (2023 - 2025)

D-Link DIR-820L devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

KB5023790: Servicing stack update for Windows Server 2012 R2: March 14, 2023

KB5023790: Servicing stack update for Windows Server 2012 R2: March 14, 2023 REMINDERWindows 8.1 reached end of support on January 10, 2023, at which point technical assistance and software updates is no longer provided. If you have devices running Windows 8.1, we recommend upgrading them to a mo...

WhatsApp refuses to weaken encryption, would rather leave UK

WhatsApp will not comply with the UK's Online Safety Bill when it passes legislation as is. In fact, WhatsApp would rather cease serving UK users, which make up 2% of its global market, than weaken its end-to-end encryption E2EE. Will Cathcart, head of WhatsApp at parent company Meta, made these...

Cross Site Scripting (XSS) in Assets

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...

Apache Log4j 1.x DoS Vulnerability (Mar 2023)

Apache Log4j is prone to a denial of service DoS vulnerability. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free softwar...

Cross-Site Scripting (XSS)

nim is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the special characters before it output to the front end, allowing an attacker to inject and execute malicious javascript on victim's browser...

CVE-2023-23911

An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the group key of a chat room...

PT-2023-19295 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to v6 Description: An improper access control issue exists that could allow an attacker to break the E2E encryption of a chat room by a user changing the group key of a chat room. Recommendations: For versions prior t...

Cross-site Scripting (XSS)

orchardcore is vulnerable to Cross-site Scripting XSS attacks. The library does not properly escape the special characters before it output to the front end, allowing an attacker to inject log entries into the database logs, containing a malicious referrer field...

Debian: Security Advisory (DLA-709)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Rittal CMC III Access systems

1. EXECUTIVE SUMMARY CVSS v3 4.8 Vendor: Rittal Equipment: CMC III Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to open control cabinets secured with Rittal locks. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Rittal...

New HiatusRAT Malware Targets Business-Grade Routers to Covertly Spy on Victims

A never-before-seen complex malware is targeting business-grade routers to covertly spy on victims in Latin America, Europe, and North America at least since July 2022. The elusive campaign, dubbed Hiatus by Lumen Black Lotus Labs, has been found to deploy two malicious binaries, a remote access...

WordPress Custom Login Admin Front-end CSS Plugin <= 1.4.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Custom Login Admin Front-end CSS Type Plugin Vulnerable versions = 1.4.1 Fixed in 1.5 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 19400bb94bda Credits Dave Jong...

CLSA-2023-1677791921 tar: Fix of CVE-2022-48303

CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...

tar: Fix of CVE-2022-48303

CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...

CLSA-2023-1677783967 tar: Fix of CVE-2022-48303

CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...

CLSA-2023-1677783889 tar: Fix of CVE-2022-48303

CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...

Gmail and Google Calendar Now Support Client-Side Encryption (CSE) to Boost Data Privacy

Google has announced the general availability of client-side encryption CSE for Gmail and Calendar, months after piloting the feature in late 2022. The data privacy controls enable "even more organizations to become arbiters of their own data and the sole party deciding who has access to it,"...

KB5022922: Servicing stack update for Windows Server 2012 R2: February 28, 2023

KB5022922: Servicing stack update for Windows Server 2012 R2: February 28, 2023 REMINDERWindows 8.1 reached end of support on January 10, 2023, at which point technical assistance and software updates is no longer provided. If you have devices running Windows 8.1, we recommend upgrading them to a...