Apple’s Timely Response to Actively Exploited Zero-Days

Summary: Apple has released crucial software updates to address two actively exploited security vulnerabilities identified as CVE-2023-42916 and CVE-2023-42917. These vulnerabilities affect the WebKit browser engine on Apple devices such as iPhone, iPad, and Mac, potentially exposing sensitive...

Actively Exploited Vulnerability in QNAP VioStor NVR: Fixed, Patches Available

...

SAP HCM Travel Management Cross-Site Scripting Vulnerability

SAP HCM Travel Management is a travel management module from SAP. A cross-site scripting vulnerability exists in SAP HCM Travel Management that stems from insufficiently encoded user input and can be exploited by an attacker to cause a cross-site scripting XSS attack...

Siemens SCALANCE M-800/S615 Series OS Command Injection Vulnerability

The SCALANCE M-800, MUM-800 and S615 and the RUGGEDCOM RM1224 are industrial routers. An operating system command injection vulnerability exists in the Siemens SCALANCE M-800/S615 series, which can be exploited by an attacker to execute commands on the system via a malicious local administrator...

Siemens SCALANCE M-800/S615 Series OS Command Injection Vulnerability

The SCALANCE M-800, MUM-800 and S615 and the RUGGEDCOM RM1224 are industrial routers. An operating system command injection vulnerability exists in the Siemens SCALANCE M-800/S615 series, which can be exploited by an attacker to execute commands on the system...

Siemens SINEC INS Denial of Service Vulnerability (CNVD-2023-97253)

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in one tool. This simplifies the installation and management of all network services associated with industrial networks. A denial of service vulnerability exists in Siemens SINEC INS, whic...

CVE-2023-42325

creationtimestamp| type| source ---|---|--- 2023-12-12 18:42:51+00:00| exploited| https://t.me/truesecator/5193 2026-07-26 02:02:16+00:00| seen| https://t.me/EchelonEyes/2294 2026-07-26 07:01:48+00:00| seen| https://t.me/zhatez/853 2026-07-27 00:00:53+00:00| seen| https://t.me/EchelonEyes/2294...

CVE-2023-6553

creationtimestamp| type| source ---|---|--- 2023-12-12 17:10:05+00:00| seen| https://t.me/truesecator/5192 2023-12-14 07:38:31+00:00| published-proof-of-concept| https://t.me/proxybar/1866 2023-12-15 07:34:50+00:00| published-proof-of-concept| https://t.me/darkcommunityofficial/193 2023-12-15...

New Critical RCE Vulnerability Discovered in Apache Struts 2 - Patch Now

Apache has released a security advisory warning of a critical security flaw in the Struts 2 open-source web application framework that could result in remote code execution. Tracked as CVE-2023-50164, the vulnerability is rooted in a flawed "file upload logic" that could enable unauthorized path...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-6448 Unitronics Vision PLC and HMI Insecure Default Password These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose...

webkitgtk: Arbitrary Remote Code Execution

A flaw was found in WebKitGTK. Processing malicious web content may lead to remote code execution. This vulnerability is known to be actively exploited in the wild and was included in the CISA's KEV catalog...

Debian DSA-5575-1 : webkit2gtk - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5575 advisory. - An out-of-bounds read was addressed with improved input validation. CVE-2023-42916 - A memory corruption vulnerability was addressed with improved locking...

CVE-2023-50428

In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code e.g., with OPFALSE OPIF, as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the...

CVE-2015-7501

creationtimestamp| type| source ---|---|--- 2023-12-08 13:11:12+00:00| seen| https://t.me/arpsyndicate/1566 2023-12-11 14:17:52+00:00| seen| https://t.me/arpsyndicate/1752 2024-02-16 15:31:43+00:00| seen| https://t.me/ctinow/186439 2026-02-02 12:25:26+00:00| exploited|...

Reentrancy in mint function leads to various problems

Lines of code Mint function in minter contract: Mint function in core contract: Vulnerability details Bug Description When minting NFTs, users will using the mint function. This function will mint a NFT using the safeMint function. The problem is that this mint will be done before crucial variabl...

Open redirect

An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP Open Charge Point Protocol for electric vehicles. The server processes mishandle StartTransaction messages containing additional, arbitrary properties, or duplicate properties. The last occurrence of a duplicate property is...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-41265 Qlik Sense HTTP Tunneling Vulnerability CVE-2023-41266 Qlik Sense Path Traversal Vulnerability These types of vulnerabilities are frequent attack vectors...

CVE-2023-20275

creationtimestamp| type| source ---|---|--- 2023-12-07 11:51:04+00:00| exploited| https://t.me/truesecator/5173 2023-12-24 16:51:49+00:00| seen| https://t.me/ctinow/159059...

Dell DM5500 Information Disclosure Vulnerability

The Dell DM5500 is an integrated solution from Dell, Inc. It provides industry-leading deduplication, data protection solutions and multi-cloud capabilities. The Dell DM5500 suffers from an information disclosure vulnerability that originates from the inclusion of a plain text password in the PPO...

Adobe ColdFusion Flaw Used by Hackers to Access US Govt Servers

By Deeba Ahmed CISA Warns of Critical Adobe ColdFusion Vulnerability Actively Exploited by Threat Actors. This is a post from HackRead.com Read the original post: Adobe ColdFusion Flaw Used by Hackers to Access US Govt Servers...