Mozilla Firefox and Firefox ESR Denial of Service Vulnerability (CNVD-2023-61753)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Firefox ESR is Firefox Enterprise Edition. A denial of service vulnerability exists in Mozilla Firefox and Firefox ESR, which can be exploited by attackers to cause the browser to crash...

WordPress Simple Ticker Plugin <= 3.05 is vulnerable to Cross Site Scripting (XSS)

Software Simple Ticker Type Plugin Vulnerable versions = 3.05 Fixed in 3.06 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bbbc4c8f4c4a Credits Unknown Required privilege Contributor...

WordPress Duplicate Post Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Duplicate Post Type Plugin Vulnerable versions = 1.4.1 Fixed in 1.4.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 80f37ad53409 Credits N/A Required privilege...

MotoCMS Code Execution Vulnerability

MotoCMS is a simple website builder from MotoCMS. A code execution vulnerability exists in MotoCMS that can be exploited by an attacker to execute arbitrary code on the system...

Ivanti patches second zero-day vulnerability being used in attacks

Ivanti has issued a patch to address a second critical zero-day vulnerability that is under active attack. The vulnerability is said to be used in combination with the first vulnerability we discussed some days ago. The Cybersecurity and Infrastructure Security Agency CISA has added the new...

CISA Known Exploited Vulnerability Catalog July 2023

For a detailed CISAs KEV Catalog, download the pdf file here Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included in the catalog, a vulnerability must meet three criteria: hav...

The Bug Report - July 2023 Edition

The Bug Report – July 2023 Edition By Trellix · August 02, 2023 This story was also written by John Dunlap. A Storm is Brewing! Why am I here? Summer is now in full swing, and our July Bug Report is similarly coming out swinging. This month comes with a red-hot list of software vulnerabilities...

Threat Actors Exploiting Ivanti EPMM Vulnerabilities

SUMMARY The Cybersecurity and Infrastructure Security Agency CISA and the Norwegian National Cyber Security Centre NCSC-NO are releasing this joint Cybersecurity Advisory CSA in response to active exploitation of CVE-2023-35078 and CVE-2023-35081. Advanced persistent threat APT actors exploited...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-35081 Ivanti Endpoint Manager Mobile EPMM Path Traversal Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and...

Liquidator can seize more tokens than the borrower has as collateral, leading to an arithmetic underflow and locking collateral.

Lines of code Vulnerability details Impact Lack of validation on seizeTokens could allow collateral locking by underflow. Proof of Concept The liquidateBorrowFresh function does not explicitly validate that seizeTokens is less than or equal to accountTokensborrower before transferring tokens from...

CVE-2023-39147

creationtimestamp| type| source ---|---|--- 2023-07-31 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/51639 2023-08-02 13:18:29+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8780 2023-08-03 16:21:52+00:00| published-proof-of-concept|...

CVE-2023-35081

creationtimestamp| type| source ---|---|--- 2023-07-29 06:39:06+00:00| exploited| Telegram/5uktbzkTAdxW1ZEWsvG16teg7VfAGOGSB2FWhK84q3VqvA 2023-07-29 06:53:37+00:00| exploited| https://t.me/AnonCyberWarrior/1961 2023-07-29 06:59:13+00:00| exploited| https://t.me/thehackernews/3667 2023-07-29...

Code injection in oscore

oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability is exploited via passing an unchecked argument...

CVE-2016-10108

creationtimestamp| type| source ---|---|--- 2023-07-28 13:22:17+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/wdmycloudunauthenticatedcmdinjection.rb 2024-10-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-10-2...

CVE-2023-38750

creationtimestamp| type| source ---|---|--- 2023-07-28 00:16:56+00:00| exploited| https://t.me/ctinow/126799 2023-07-28 16:05:05+00:00| exploited| https://t.me/truesecator/4670 2023-07-31 20:37:58+00:00| seen| https://t.me/cibsecurity/67485...

CVE-2023-39023

university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.DefaultExecutorManager.configure. This vulnerability is exploited via passing an unchecked argument...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-37580 Zimbra Collaboration ZCS Cross-Site Scripting XSS Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and...

Patch now! Ivanti Endpoint Manager Mobile Authentication vulnerability used in the wild

The Cybersecurity and Infrastructure Security Agency CISA added one new vulnerability to its Known Exploited Vulnerabilities Catalog affecting Ivanti Endpoint Manager Mobile, based on evidence of active exploitation. All Federal Civilian Executive Branch FCEB agencies must remediate this...

CVE-2023-38606

This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a...

CVE-2023-37450

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited...