CVE-2022-48618

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been...

CISA Known Exploited Vulnerability Catalog December 2023

For a detailed CISAs KEV Catalog, download the pdf file here Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. It is recommended that all organizations review and monitor the KEV catalog,...

Information Disclosure

pyload-ng is vulnerable to Unauthenticated Information Disclosure. The vulnerability is due to improper authorization and authentication checks. This issue can be exploited by an attacker to disclose sensitive information such as Flask configurations, which includes the SECRETKEY variable...

CVE-2024-0305

creationtimestamp| type| source ---|---|--- 2024-01-08 10:26:30+00:00| seen| https://t.me/ctinow/164264 2024-01-12 01:51:59+00:00| seen| https://t.me/ctinow/166993 2024-01-25 10:11:16+00:00| seen| https://t.me/ctinow/173353 2024-01-26 17:59:24+00:00| seen| https://t.me/arpsyndicate/3023 2024-12-2...

CVE-2023-31446

creationtimestamp| type| source ---|---|--- 2024-01-07 22:09:15+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/9743 2024-01-08 09:16:40+00:00| seen| https://t.me/ctinow/164237 2024-01-10 04:26:20+00:00| seen| https://t.me/ctinow/165527 2024-01-27 07:07:25+00:00| seen|...

CVE-2024-0260 SourceCodester Engineers Online Portal Password Change change_password_teacher.php session expiration

A vulnerability, which was classified as problematic, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file changepasswordteacher.php of the component Password Change. The manipulation leads to session expiration. It is possible to launch the attack...

Attacks, Vulnerabilities and Actors 25 December to 31 December 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of eight executed attacks, four instances of adversary activity, and five exploited...

CISA Warns of Exploited Vulnerabilities in Chrome and Excel Parsing Library

By Waqas CISA Urges Swift Action as Two Critical Vulnerabilities Emerge. This is a post from HackRead.com Read the original post: CISA Warns of Exploited Vulnerabilities in Chrome and Excel Parsing Library...

CVE-2023-41779 Illegal Memory Access Vulnerability of ZTE's ZXCLOUD iRAI

There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed...

PT-2024-15211 · Undefined · Undefined

CISA Adds Two Critical Vulnerabilities to Watchlist: CVE-2023-7024 and CVE-2023-7121 https://t.co/rmCaodWk1k CISA has added two additional vulnerabilities to its Known Exploited Vulnerabilities Catalog for January 2024. The two additions have been made following evidence of ac…...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-7024 Google Chromium WebRTC Heap Buffer Overflow Vulnerability CVE-2023-7101 Spreadsheet::ParseExcel Remote Code Execution Vulnerability These types of...

GitLab 14.5 < 15.1.6 / 15.2 < 15.2.4 / 15.3 < 15.3.2 (CVE-2022-3331)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab'...

GHSA-FJ3M-2R8F-M4X9

creationtimestamp| type| source ---|---|--- 2023-12-29 12:23:29+00:00| exploited| https://t.me/arpsyndicate/2248...

Attacks, Vulnerabilities and Actors 18 December to 24 December 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of 15 executed attacks, 4 instances of adversary activity, and 7 exploited vulnerabilities,...

WordPress CRM Perks Forms Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Software CRM Perks Forms Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51536 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e48c62e620dc Credits Huynh Tien Si Required privilege...

CVE-2023-49807

Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-49779

Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-47215

Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-42436

Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

Cross site scripting

Stored cross-site scripting vulnerability exists in the App Settings /admin/app page, the Markdown Settings /admin/markdown page, and the Customize /admin/customize page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser o...