Unchecked Call Return Value

Lines of code Vulnerability details Impact The functions do not check the return value of low-level calls. This can lock Ether in the contract if the call fails or may compromise the contract if the ownership is being changed. The following calls were detected without return value validations -...

GHSA-C7HH-3V6C-FJ4Q matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms

Impact It was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Patches Please upgrade to 1.0.1. Workarounds You can set the matrixHandler.eventCacheSize config value to 0 to workaround this...

matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms

Impact It was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Patches Please upgrade to 1.0.1. Workarounds You can set the matrixHandler.eventCacheSize config value to 0 to workaround this...

CVE-2023-4069

creationtimestamp| type| source ---|---|--- 2023-08-03 15:05:05+00:00| seen| https://t.me/truesecator/4689 2023-10-26 06:10:31+00:00| published-proof-of-concept| https://t.me/WARLOCKDARKARMYOFFICIALS/3477 2023-10-26 10:59:01+00:00| published-proof-of-concept|...

Microsoft Flags Growing Cybersecurity Concerns for Major Sporting Events

Microsoft is warning of the threat malicious cyber actors pose to stadium operations, noting that the cyber risk surface of live sporting events is "rapidly expanding." "Information on athletic performance, competitive advantage, and personal information is a lucrative target," the company said i...

Cyber Signals: Sporting events and venues draw cyberthreats at increasing rates

Today we released the fifth edition of Cyber Signals, spotlighting threats to large venues, and sporting and entertainment events, based on our learnings and telemetry from delivering cybersecurity support to critical infrastructure facilities during the State of Qatar’s hosting of the FIFA World...

CVE-2023-35082

creationtimestamp| type| source ---|---|--- 2023-08-03 05:38:04+00:00| published-proof-of-concept| https://t.me/CyberWatchinsider/12 2023-08-03 06:21:25+00:00| published-proof-of-concept| https://t.me/thehackernews/3688 2023-08-03 07:23:03+00:00| exploited|...

SUSE SLES15 Security Update : kernel (Live Patch 3 for SLE 15 SP4) (SUSE-SU-2023:3063-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3063-1 advisory. This update for the Linux Kernel 5.14.21-1504002421 fixes several issues. The following security issues were fixed: - CVE-2023-35788: Fixed an...

Rudder Server SQL Injection / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Rudder Server SQLI Remote Code Execution', 'Description' = %q This Metasploit module exploits a SQL injection vulnerability in RudderStack's...

PT-2023-27021 · WordPress · Instawp Connect

Name of the Vulnerable Software and Affected Versions: InstaWP Connect plugin for WordPress versions up to, and including, 0.0.9.18 Description: The issue allows unauthorized access, modification, and loss of data due to a missing capability check on the events receiver function. This enables...

WordPress plugin InstaWP Connect 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress The Events Calendar Plugin <= 6.1.2.2 is vulnerable to Broken Access Control

Software The Events Calendar Type Plugin Vulnerable versions = 6.1.2.2 Fixed in 6.1.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-35777 Patch priority Low CVSS severity Low 5.3 Developer Liquid Web / StellarWP PSID 208e7faf967d Credits PetiteMais...

WordPress Events Manager 5.61 SQL Injection

==================================================================================================================================== | Title : Wordpress Events Manager plugin 5.61 Blind SQL Injection | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

CVE-2023-33951

creationtimestamp| type| source ---|---|--- 2023-07-24 20:30:01+00:00| seen| https://t.me/cibsecurity/67173...

CVE-2023-3863

creationtimestamp| type| source ---|---|--- 2023-07-24 18:26:09+00:00| seen| https://t.me/cibsecurity/67151 2024-02-02 15:27:20+00:00| seen| https://t.me/ctinow/178116...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to the incorrect authorization during the display of Audit Events, which allows developers to view the project's Audit Events and developers or maintainers to view the group's Audit Events...

GHSA-FMQQ-25X9-C6HM Indico vulnerable to Cross-Site-Scripting via confirmation prompts

Impact There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges such as a speaker and then someone else to attempt to delete this content. Considering that event...

CVE-2023-3787

A vulnerability classified as problematic was found in Codecanyon Tiva Events Calender 1.4. This vulnerability affects unknown code. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be...

CVE-2023-3787

A vulnerability classified as problematic was found in Codecanyon Tiva Events Calender 1.4. This vulnerability affects unknown code. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be...

Cross site scripting

A vulnerability classified as problematic was found in Codecanyon Tiva Events Calender 1.4. This vulnerability affects unknown code. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be...