CVE-2023-37450

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited...

CVE-2023-37450

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited...

Code injection

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited...

Diafan CMS Cross-Site Scripting Vulnerability

Diafan CMS is a website builder from Diafan. It is used to create online stores. A cross-site scripting vulnerability exists in Diafan CMS v6.0, which originates from the lack of effective filtering and escaping of user-supplied data in the catid parameter of /shop/?module=shop&action=search, whi...

CVE-2023-37450

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Recen...

CVE-2023-38606

This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a...

CVE-2023-38606

This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a...

CVE-2023-37450

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited...

CVE-2023-35078: Critical API Access Vulnerability in Ivanti Endpoint Manager Mobile

CVE-2023-35078 is a remote unauthenticated API access vulnerability in Ivanti Endpoint Manager Mobile, which was previously branded as MobileIron Core. The vulnerability has a CVSS v3 base score of 10.0 and has a severity rating of Critical. Ivanti has reported that they have received information...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-38606 Apple Multiple Products Kernel Unspecified Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-35078 Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors an...

CVE-2023-35078

creationtimestamp| type| source ---|---|--- 2023-07-25 05:48:54+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus12/2023 2023-07-25 05:55:59+00:00| seen| https://t.me/thehackernews/3640 2023-07-25 07:26:05+00:00| exploited| Telegram/qHzLqnpkQ6lkNyVJiJ3c0QdKbofQ14FsTmwbpCsMwHtLV...

CVE-2023-38501

creationtimestamp| type| source ---|---|--- 2023-07-23 16:22:59+00:00| published-proof-of-concept| https://github.com/9001/copyparty/security/advisories/GHSA-f54q-j679-p9hh 2023-07-26 02:27:12+00:00| seen| https://t.me/cibsecurity/67279 2023-07-28 00:00:00+00:00| exploited|...

CVE-2023-38646

creationtimestamp| type| source ---|---|--- 2023-07-21 18:23:35+00:00| seen| https://t.me/cibsecurity/67096 2023-07-28 08:03:20+00:00| seen| https://t.me/KomunitiSiber/561 2023-07-28 09:30:08+00:00| seen| https://t.me/thehackernews/3661 2023-07-28 09:56:43+00:00| seen|...

CVE-2023-35885

creationtimestamp| type| source ---|---|--- 2023-07-21 10:59:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8707 2023-07-22 15:31:47+00:00| published-proof-of-concept| Telegram/72q6K-Gw2SSBLexfL7RRBs4aQAazbzl569yjTYRGLrjOQ 2023-07-23 03:58:34+00:00|...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-29298 Adobe ColdFusion Improper Access Control Vulnerability CVE-2023-38205 Adobe ColdFusion Improper Access Control Vulnerability These types of vulnerabiliti...

Citrix Netscaler ADC and Gateway Vulnerabilities Exploited in the Wild

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Citrix has released a zero-day critical patch for a remote code execution vulnerability in Netscaler ADC and Netscaler Gateway that has been exploited, along with two other vulnerabilities. Urgent...

Adobe Rolls Out New Patches for Actively Exploited ColdFusion Vulnerability

Adobe has released a fresh round of updates to address an incomplete fix for a recently disclosed ColdFusion flaw that has come under active exploitation in the wild. The critical shortcoming, tracked as CVE-2023-38205 CVSS score: 7.5, has been described as an instance of improper access control...

WordPress Disabler Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Disabler Type Plugin Vulnerable versions = 3.0.3 Fixed in 4.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-37998 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID cee9091d2325 Credits Skalucy Required privilege...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2023-65512)

Oracle MySQL Server is a relational database from Oracle Corporation. A security vulnerability exists in Oracle MySQL Server, which can be exploited by attackers to cause unauthorized MySQL server hangs or frequent and repeated crashes full DOS...