Input validation

An Improper Input Validation vulnerability in the Routing Protocol Daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service DoS. When certain specific crafted BGP UPDATE messages are received over an established BG...

Fedora 37 : mosquitto (2023-e7ed15ab9e)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e7ed15ab9e advisory. 2.0.17 Broker: Fix maxqueuedmessages 0 stopping clients from receiving messages Fix maxinflightmessages not being set correctly. Apps: Fix...

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

CVE-2023-4481

CVE-2023-4481 describes an improper input validation in Juniper’s Routing Protocol Daemon (rpd) for Junos OS and Junos OS Evolved. A remote, unauthenticated attacker can cause a DoS by sending crafted BGP UPDATE messages over an existing BGP session; the impact can be sustained as updates are pro...

CVE-2023-31168

creationtimestamp| type| source ---|---|--- 2023-08-31 20:13:33+00:00| seen| https://t.me/cibsecurity/69574 2023-09-06 13:09:23+00:00| seen| https://t.me/KomunitiSiber/749 2023-09-06 14:28:04+00:00| seen| Telegram/H3UUabEv1xs7Kg01Ip9h9p1g1MjfOWbKEpWB7-OtFk2Ew...

CVE-2023-4023

The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...

Unveiling New Windows Ransomware Named Trash Panda

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Trash Panda is a ransomware that encrypts files on Windows machines, replaces the desktop wallpaper, and drops a ransom note with political messages. It adds a ‘.monochrome’ extension to the encrypted...

WordPress plugin All Users Messenger 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

Cleartext Signed Message Signature Spoofing in openpgp

Impact OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 This text is signed. -----BEGIN PGP SIGNATURE----- wnUEARMIACcFgmTkrNAJkInXCgj0fgcIFiEE1JlKzzDGQxZmmHkYidcKCPR+...

CVE-2023-41037

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorit...

Design/Logic Flaw

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorit...

CVE-2023-41037 Cleartext Signed Message Signature Spoofing in openpgpjs

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorit...

PT-2023-27753 · Unknown · Openpgp.Js

Name of the Vulnerable Software and Affected Versions: OpenPGP.js versions up to 5.9.0 OpenPGP.js version 5.10.1 current stable version is not affected, and version 4.10.11 legacy version is also not affected. Description: OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In...

CVE-2023-40758

User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

CVE-2023-40195

creationtimestamp| type| source ---|---|--- 2023-08-28 12:26:58+00:00| seen| https://t.me/cibsecurity/69273 2023-09-08 16:07:57+00:00| seen| https://t.me/ctinow/135724...

PT-2023-27627 · Phpjabbers · Phpjabbers Fundraising Script

Name of the Vulnerable Software and Affected Versions: PHPJabbers Fundraising Script version 1.0 Description: The issue is related to user enumeration, which occurs during the password recovery process. A difference in messages could allow an attacker to determine if a user is valid or not,...

PT-2023-27623 · Phpjabbers · Phpjabbers Document Creator

Name of the Vulnerable Software and Affected Versions: PHPJabbers Document Creator version 1.0 Description: The issue is related to user enumeration, which occurs during the password recovery process. A difference in messages could allow an attacker to determine if a user is valid or not, enablin...

PT-2023-27628 · Phpjabbers · Phpjabbers Taxi Booking Script

Name of the Vulnerable Software and Affected Versions: PHPJabbers Taxi Booking Script version 2.0 Description: The issue is related to user enumeration, which occurs during the password recovery process. A difference in messages could allow an attacker to determine if a user is valid or not,...

CVE-2023-32678 Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream and have been removed from it since retain the ability to edit messages/topics, move messages to other streams, and delete messages that the...