CVE-2023-2735 Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ghform' shortcode in versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2023-2735 Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ghform' shortcode in versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

All your building are belong to us

TL;DR Building Management Systems BMS bring new risks to businesses that havent had previous experience of securing Operational Technology OT While there might not be direct financial gain from hacking BMS, these systems can be a soft target for attackers to pivot into your business operations. I...

Update now! Ruckus vulnerability added to CISA’s list of actively exploited bugs

Along with six older vulnerabilities, the Cybersecurity and Infrastructure Agency CISA has added a vulnerability in multiple Ruckus wireless products to the Known Exploited Vulnerabilities Catalog. This means that Federal Civilian Executive Branch FCEB agencies need to remediate these...

CVE-2023-32787

The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications...

CVE-2023-32787

The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications...

CVE-2023-32787

The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications...

PT-2023-24020 · Unknown · Opc Ua Legacy Java Stack

Name of the Vulnerable Software and Affected Versions: OPC UA Legacy Java Stack versions prior to 6f176f2 Description: The issue allows an attacker to block OPC UA server applications via uncontrolled resource consumption, causing them to be unable to serve client applications. This is a...

CVE-2023-32787

CVE-2023-32787 affects the OPC UA Legacy Java Stack prior to 6f176f2. It enables an attacker to cause denial of service via uncontrolled resource consumption, blocking OPC UA server applications from servicing clients. The issue is network‑feasible (per CVSS) and the documented fix is to update t...

OPC UA Legacy Java Stack 资源管理错误漏洞

The OPC UA Legacy Java Stack is a legacy support for the Java version of OPC UA from the OPC Foundation of America. A security vulnerability exists in versions of the OPC UA Legacy Java Stack prior to 6f176f2, which stems from an attacker's ability to block an OPC UA server application through...

wireshark security and bug fix update

1:3.4.10-4 - Resolves: 2152064 - CVE-2022-3190 wireshark: f5ethtrailer Infinite loop in legacy style dissector 1:3.4.10-3 - Resolves: 2083581 - capinfos aborts in FIPS 1:3.4.10-2 - Resolves: 2160648 - Enhanced TMT testing for centos-stream...

Vulnerabilities fixed in VMWare Aria

VMWare has fixed vulnerabilities in Aria formerly: vRealize. A malicious party could exploit the vulnerabilities to execute arbitrary execute arbitrary commands as "root. For successful abuse, it is necessary that the malicious party already has elevated privileges has. The vulnerability with...

Debian: Security Advisory (DLA-3418-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DLA-3418-1 nvidia-graphics-drivers-legacy-390xx - security update

Bulletin has no description...

openssl: Using a Custom Cipher with NID_undef may lead to NULL encryption

A flaw was found in OpenSSL, where it incorrectly handles legacy custom ciphers passed to the EVPEncryptInitex2, EVPDecryptInitex2 and EVPCipherInitex2 functions as well as other similarly named encryption and decryption initialization functions. Instead of using the custom cipher directly, it...

CVE-2023-21404

AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static RSA key is not used in any other secure communication nor can it be used to compromise the device or any customer data...

CVE-2023-21404

AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static RSA key is not used in any other secure communication nor can it be used to compromise the device or any customer data...

AXIS OS 安全漏洞

AXIS Os is an edge device operating system from Axis Sweden. A security vulnerability exists in AXIS OS versions 11.0.x-11.3.x, which stems from the use of static RSA keys in legacy LUA components to protect Axis-specific source code...

PT-2023-18177 · Axis · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS versions 11.0.X through 11.3.x Description: The issue concerns the use of a static RSA key in legacy LUA-components to protect Axis-specific source code. This static RSA key is not utilized in any other secure communication and cannot...

Cross Site Scripting in OpenTSDB

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...