PT-2023-22926 · Gallery · Gallery

Name of the Vulnerable Software and Affected Versions: Gallery versions prior to 14.5.01.2 Description: The issue is related to improper authentication in the GallerySearchProvider of Gallery, allowing an attacker to access search history. Recommendations: For versions prior to 14.5.01.2, update ...

X (Twitter) to Collect Biometric Data from Premium Users to Combat Impersonation

X, the social media site formerly known as Twitter, has updated its privacy policy to collect users' biometric data to tackle fraud and impersonation on the platform. "Based on your consent, we may collect and use your biometric information for safety, security, and identification purposes," the...

A week in security (August 28 - September 3)

Last week on Malwarebytes Labs: 2.6 million DuoLingo users have scraped data released Google strengthens its Workplace suite protection Meal delivery service PurFoods announces major data breach Cisco VPNs without MFA are under attack by ransomware operator "An influx of Elons," a hospital visit,...

CVE-2023-36076

SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php...

CVE-2023-36076

SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php...

Spyware Vendor Hacked

A Brazilian spyware app vendor was hacked by activists: In an undated note seen by TechCrunch, the unnamed hackers described how they found and exploited several security vulnerabilities that allowed them to compromise WebDetetive’s servers and access its user databases. By exploiting other flaws...

CVE-2023-36076

SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php...

CVE-2023-36076

SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php...

Smanga SQL Injection Vulnerability

Smanga is a docker direct-installed comic streaming reading tool by lkw199711 individual developer. A SQL injection vulnerability exists in smanga 3.1.9 and earlier versions, which allows remote attackers to execute arbitrary code and obtain sensitive information via the mediaId, mangaId, and...

CVE-2023-36076

SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php...

Social Security Numbers leaked in ransomware attack on Ohio History Connection

The Ohio History Connection OHC has posted a breach notification in which it discloses that a ransomware attack successfully encrypted internal data servers. During the attack, the cybercriminals may have had access to names, addresses, and Social Security Numbers SSNs of current and former OHC...

CVE-2023-39026

creationtimestamp| type| source ---|---|--- 2023-08-23 02:12:01+00:00| seen| https://t.me/cibsecurity/69043 2023-10-23 19:27:06+00:00| published-proof-of-concept| Telegram/X8AxNFp0HQTngPQfgKr7iAFqHeL4fj8-bjEOb-q8Rk 2023-10-24 15:05:53+00:00| published-proof-of-concept| https://t.me/CNArsenal/1351...

WordPress Timeline and History slider Plugin <= 2.1 is vulnerable to Broken Access Control

Software Timeline and History slider Type Plugin Vulnerable versions = 2.1 Fixed in 2.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a3a9df023238 Credits Abdi Pranata Requir...

USN-6238-1: Samba vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that Samba incorrectly handled Winbind NTLM authentication responses. An attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. CVE-2022-2127...

PT-2023-4366 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to an elevation-of-privilege vulnerability in the Windows Kernel, which is associated with insufficient access control. This vulnerability can be exploited by an attack...

2022's most routinely exploited vulnerabilities—history repeats

The Cybersecurity and Infrastructure Security Agency CISA, National Security Agency NSA, Federal Bureau of Investigation FBI, and international partners have released a joint Cybersecurity Advisory CSA called the 2022 Top Routinely Exploited Vulnerabilities. We went over the list and it felt like...

CVE-2023-30625

creationtimestamp| type| source ---|---|--- 2023-07-31 13:41:50+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rudderserversqlirce.rb 2023-10-04 00:55:17+00:00| published-proof-of-concept| https://t.me/codeb0ss/1207 2023-10-11 03:23:45+00:00|...

It's possible to block some user from voting for (or against) some proposal

Lines of code Vulnerability details Note: Although some code involved is inside a contract which is out of scope, I argue that this finding is in scope, since the vulnerability exists in the in-scope contract. In the Arcade protocol, there are several voting vaults implemented so that users can u...

CVE-2023-38523

The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, without authentication, exposing sensitive information such as the command history and screenshot of the file being processed. This affects N-Series N1115 Wallplate Video Encoder...

CVE-2023-38523

The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, without authentication, exposing sensitive information such as the command history and screenshot of the file being processed. This affects N-Series N1115 Wallplate Video Encoder...