CVE-2023-33294

An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctwebserver binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns...

CVE-2023-33294

An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctwebserver binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns...

CVE-2023-23890

Cross-Site Request Forgery CSRF vulnerability in LJ Apps WP Airbnb Review Slider plugin = 3.2 versions...

CVE-2023-23890

Cross-Site Request Forgery CSRF vulnerability in LJ Apps WP Airbnb Review Slider plugin = 3.2 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in LJ Apps WP Airbnb Review Slider plugin = 3.2 versions...

CVE-2023-23890

CVE-2023-23890 affects the WordPress plugin WP Airbnb Review Slider (LJ Apps) versioned up to 3.2. The vulnerability is a Cross-Site Request Forgery (CSRF) that can lead to reviews being removed; Patch details indicate the issue is exploitable by an unauthenticated attacker and is fixed in versio...

CVE-2023-23890

Cross-Site Request Forgery CSRF vulnerability in LJ Apps WP Airbnb Review Slider plugin = 3.2 versions...

CVE-2023-23890: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in LJ Apps WP Airbnb Review Slider plugin = 3.2 versions...

Apple Thwarts $2 Billion in App Store Fraud, Rejects 1.7 Million App Submissions

Apple has announced that it prevented over $2 billion in potentially fraudulent transactions and rejected roughly 1.7 million app submissions for privacy and security violations in 2022. The computing giant said it terminated 428,000 developer accounts for potential fraudulent activity, blocked...

Apple Thwarts $2 Billion in App Store Fraud, Rejects 1.7 Million App Submissions

Apple has announced that it prevented over $2 billion in potentially fraudulent transactions and rejected roughly 1.7 million app submissions for privacy and security violations in 2022. The computing giant said it terminated 428,000 developer accounts for potential fraudulent activity, blocked...

Apple macOS Ventura security vulnerabilities

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura version 13.4, which arises from the possibility that rights and privacy permissions granted to this application could be used by malicious applications...

Facebook Hermes resource management error vulnerability

Facebook Hermes is a JavaScript engine from Facebook Inc. in the United States. The engine is targeted at React Native applications to improve the performance of mobile client application apps, but not for server-side infrastructures such as browsers & Node.js. A security vulnerability exists in...

OilAlpha: Emerging Houthi-linked Cyber Threat Targets Arabian Android Users

A hacking group dubbed OilAlpha with suspected ties to Yemen's Houthi movement has been linked to a cyber espionage campaign targeting development, humanitarian, media, and non-governmental organizations in the Arabian peninsula. "OilAlpha used encrypted chat messengers like WhatsApp to launch...

CVE-2023-21116

In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for...

CVE-2023-21116

In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for...

PT-2023-17908 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-11 through Android-13 Description: A logic error in the code of InstallPackageHelper.java, specifically in the verifyReplacingVersionCode function, allows for a possible downgrade of system apps below the system image...

Microsoft Office Microsoft 365 Apps for Enterprise DoS

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise programs exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to perform service denial-of-service attacks...

Microsoft Office Code Execution

The vulnerability of Microsoft Excel, Microsoft Office, Microsoft 365 Apps for Enterprise, Microsoft SharePoint, and Microsoft Office Online Server relates to the execution of operations outside of the buffer in memory. Exploitation of this vulnerability can allow an attacker to execute arbitrary...

App-V Privilege Escalation Command Execution

The vulnerability of the App-V software service for virtualizing and delivering Citrix Virtual Apps and Desktops formerly XenApp and XenDesktop on Windows operating systems is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiti...

Operation ChattyGoblin: Hackers Targeting Gambling Firms via Chat Apps

A gambling company in the Philippines was the target of a China-aligned threat actor as part of a campaign that has been ongoing since October 2021. Slovak cybersecurity firm ESET is tracking the series of attacks against Southeast Asian gambling companies under the name Operation ChattyGoblin...