CVE-2023-6021

creationtimestamp| type| source ---|---|--- 2023-11-25 12:14:52+00:00| published-proof-of-concept| Telegram/B3MfWlGpx-qQr-PJTpFgE5RGDaIYA5WKuQnODf6UIO8APlw 2024-03-27 17:30:05+00:00| exploited| https://t.me/truesecator/5575 2024-11-17 03:14:18+00:00| published-proof-of-concept|...

WordPress Awesome Support Plugin <= 6.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Awesome Support Type Plugin Vulnerable versions = 6.1.4 Fixed in 6.1.5 OWASP Top 10 A2: Broken Authentication Classification Cross Site Request Forgery CSRF CVE CVE-2023-48323 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID afdaccd9618c Credits thiennv Required...

CVE-2023-49103

creationtimestamp| type| source ---|---|--- 2023-11-22 17:10:53+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5912 2023-11-23 07:46:50+00:00| published-proof-of-concept| https://t.me/proxybar/1841 2023-11-23 09:27:42+00:00| seen|...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-4911 GNU C Library Buffer Overflow Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks...

Adobe After Effects Out-of-Bounds Read Vulnerability (CNVD-2023-91792)

Adobe After Effects is a set of visual effects and motion graphics production software from the American company Audobee Adobe. The software is mainly used for 2D and 3D synthesis, animation and visual effects production. An out-of-bounds read vulnerability exists in Adobe After Effects versions...

Adobe After Effects Uninitialized Pointer Access Vulnerability

Adobe After Effects is a set of visual effects and motion graphics production software from the American company Audobee Adobe. The software is mainly used for 2D and 3D synthesis, animation and visual effects production. An uninitialized pointer access vulnerability exists in Adobe After Effects...

Adobe RoboHelp Server Information Disclosure Vulnerability

Adobe RoboHelp Server is a server-based application for FrameMaker and RoboHelp enterprise users. An information disclosure vulnerability exists in Adobe RoboHelp Server, which can be exploited by an attacker to obtain sensitive information...

Adobe Animate Out-of-Bounds Read Vulnerability (CNVD-2023-91795)

Adobe Animate is a set of Flash animation software from the American company Audobee Adobe. An out-of-bounds read vulnerability exists in Adobe Animate 23.0.2 and earlier versions, which can be exploited by attackers to obtain sensitive information...

Adobe Media Encoder Out-of-Bounds Read Vulnerability (CNVD-2023-100306)

Adobe Media Encoder is an audio and video encoding application from the American company Audobee Adobe. Adobe Media Encoder suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to execute arbitrary code on a system...

Adobe Premiere Pro Out-of-Bounds Read Vulnerability (CNVD-2023-95448)

Adobe Premiere Pro is a set of non-linear editing video editing software from the American company Audobee Adobe. Adobe Premiere Pro suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to execute code in the context of the current user...

Adobe Audition Out-of-Bounds Read Vulnerability (CNVD-2023-88659)

Adobe Audition is a set of multi-track editing tools from the American company Audobee Adobe. The product is mainly used to include multi-track, waveforms and spectral display of the perfect toolset for audio content mixing, editing and creation. An out-of-bounds read vulnerability exists in Adob...

CVE-2019-15642

creationtimestamp| type| source ---|---|--- 2023-11-17 05:26:25+00:00| seen| https://t.me/arpsyndicate/209 2024-12-25 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2024-12-25 2025-01-14 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabiliti...

Zero-Day Flaw in Zimbra Email Software Exploited by Four Hacker Groups

A zero-day flaw in the Zimbra Collaboration email software was exploited by four different groups in real-world attacks to pilfer email data, user credentials, and authentication tokens. "Most of this activity occurred after the initial fix became public on GitHub," Google Threat Analysis Group T...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-36584 Microsoft Windows Mark of the Web MOTW Security Feature Bypass Vulnerability CVE-2023-1671 Sophos Web Appliance Command Injection Vulnerability...

WordPress wpMandrill Plugin <= 1.33 is vulnerable to Broken Access Control

Software wpMandrill Type Plugin Vulnerable versions = 1.33 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47828 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ca3867a3ec02 Credits Abdi Pranata Required privilege...

Microsoft Office Graphics Code Execution Vulnerability

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Common components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A code execution vulnerability exists in Microsoft Office Graphics, which can be exploited by an...

CVE-2023-34982

This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service...

Attacks, Vulnerabilities and Actors 6 November to 12 November 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of twenty-five executed attacks, six instances of adversary activity, and four exploited...

Multiple Critical Vulnerabilities in Juniper Exploited in the Wild

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Multiple vulnerabilities have been discovered in Juniper Networks Junos OS, with the potential for pre-auth Remote Code Execution when chained in Juniper devices. Juniper Networks has confirmed th...

Malicious first depositor can steal all funds from all future depositors

Lines of code Vulnerability details Impact Due to a miscalculation in LRTOraclegetRSETHPrice, users who call LRTDepositPooldepositAsset when rsETH.totalSupply is non-zero will receive fewer rsETH tokens than they should due to a rounding error. This can be exploited by a malicious first depositor...