2023 CWE Top 25 Most Dangerous Software Weaknesses

The Homeland Security Systems Engineering and Development Institute, sponsored by the Department of Homeland Security and operated by MITRE, has released the 2023 Common Weakness Enumeration CWE Top 25 Most Dangerous Software Weaknesseslink is external. The CWE Top 25 is calculated by analyzing...

Gibbon 路径遍历漏洞

Gibbon is a school platform that solves real-world problems that educators encounter every day. A security vulnerability exists in Gibbon version 25.0.0 that stems from the presence of a local file inclusion vulnerability. An attacker can exploit the vulnerability to include local files in a serv...

Gibbon 跨站脚本漏洞

Gibbon is a school platform that solves real-world problems that educators encounter every day. A security vulnerability exists in Gibbon version 25.0.0 that stems from the presence of a cross-site scripting XSS vulnerability that allows an attacker to execute arbitrary Javascript code...

ILIAS 跨站脚本漏洞

ILIAS is an open source learning management system. A security vulnerability exists in ILIAS versions 7.21, 8.0beta1 through 8.2, which stems from susceptibility to reflected cross-site scripting XSS...

ILIAS 跨站脚本漏洞

ILIAS is an open source learning management system. A security vulnerability exists in ILIAS versions 7.21, 8.0beta1, and 8.2 that stems from susceptibility to stored cross-site scripting XSS attacks...

CVE-2023-21211

creationtimestamp| type| source ---|---|--- 2023-06-28 22:19:11+00:00| seen| https://t.me/cibsecurity/65659...

CVE-2023-26134

creationtimestamp| type| source ---|---|--- 2023-06-28 12:12:44+00:00| seen| https://t.me/cibsecurity/65604 2025-01-29 21:02:06+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lgvujk67bc27 2025-11-08 07:52:31+00:00| seen|...

June 27, 2023—KB5027293 (OS Build 19045.3155) Preview

None None...

CVE-2020-23065

creationtimestamp| type| source ---|---|--- 2023-06-26 22:11:13+00:00| seen| https://t.me/cibsecurity/65527...

PT-2023-9687 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A flaw in the experimental permission model of Node.js version 20 allows malicious actors to retrieve stats from files they do not have explicit read access to when the --allow-fs-read flag is used with a non-...

SUSE CVE-2023-30583

fs.openAsBlob can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob API. Please note that at the time this CVE was issued, the permission model is an...

SUSE CVE-2023-30581

The use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time...

SUSE CVE-2023-30584

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an...

Node.js 安全漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js version 20 that stems from the presence of path traversal...

Node.js 安全漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js version 20 that stems from a lack of checks to bypass the experimental privilege model...

Node.js 安全漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js version 20 that stems from an inadequate permission model that fails to restrict file monitoring via the fs. watchFile API, which allows an attacker to monitor files for which they...

USN-6180-1 vlc vulnerabilities

It was discovered that VLC could be made to read out of bounds when decoding image files. If a user were tricked into opening a crafted image file, a remote attacker could possibly use this issue to cause VLC to crash, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and...

Actors, Threats and Vulnerabilities 12 June to 18 June 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries related to cybersecurity threats. Over the past week, the fact that there were a total of seven attacks executed, taking advantage of twenty different vulnerabilities in...

PT-2023-4523 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A vulnerability has been discovered in Node.js, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. The...

PT-2023-4496 · Node.Js +7 · Node.Js +7

Name of the Vulnerable Software and Affected Versions: Node.js versions v16, v18, and v20 Description: The issue is related to the use of proto in process.mainModule. proto .require, which can bypass the policy mechanism and allow requiring modules outside of the policy.json definition. This...