CVE-2023-23709: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Denis WPJAM Basic plugin = 6.2.1 versions...

CVE-2023-23901: Improper Certificate Validation

Improper following of a certificate's chain of trust exists in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, which may allow a remote unauthenticated attacker to eavesdrop on or alter the communication sent to the WebUI of the...

CVE-2023-25833: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser no stateful change made or customer data rendered...

CVE-2023-23901

CVE-2023-23901 affects Seiko Solutions SkyBridge MB-A200 firmware (01.00.05 and earlier) and SkyBridge BASIC MB-A130 firmware (1.4.1 and earlier). Root cause: improper following of a certificate’s chain of trust. Impact: remote unauthenticated attacker may eavesdrop on or alter communications sen...

Intel Bios security vulnerabilities

Intel Bios is a basic input-output system from Intel Corporation USA used to perform hardware initialization during the power-on boot phase, as well as firmware that provides runtime services to the operating system. A security vulnerability exists in Intel Bios. An attacker could exploit the...

Seiko Solutions SkyBridge security vulnerability

Seiko Solutions SkyBridge is a series of routers from Seiko Solutions, Japan. A security vulnerability exists in Seiko Solutions SkyBridge and SkySpider. An attacker could exploit the vulnerability to decrypt the password of the product's WebUI. The following products and versions are affected:...

CVE-2023-0007: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed...

kernel: BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c

A list corruption flaw was found in cfg80211addnontranslist in the net/wireless/scan.c function in the Linux kernel. This flaw could lead to a denial of service...

CVE-2023-1384: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3...

Healthy security habits to fight credential breaches: Cyberattack Series

Fifty percent of Microsoft cybersecurity recovery engagements relate to ransomware,1 and 61 percent of all breaches involve credentials.2 In this second report in our ongoing Cyberattack Series, we look at the steps taken to discover, understand, and respond to a push-bombing request that targete...

H3C Magic R200 Buffer Error Vulnerability

The H3C Magic R200 is a router from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic R200 R200V100R004 version, which stems from the EditBasicSSID5G interface via /goform/aspForm found to contain a stack overflow vulnerability...

WordPress WPJAM Basic Plugin <= 6.2.1 is vulnerable to Cross Site Scripting (XSS)

Software WPJAM Basic Type Plugin Vulnerable versions = 6.2.1 Fixed in 6.2.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23709 Patch priority Low CVSS severity Low 6.5 Developer Denishua PSID 863497ab977f Credits István Márton Required privilege...

Blind Eagle Cyber Espionage Group Strikes Again: New Attack Chain Uncovered

The cyber espionage actor tracked as Blind Eagle has been linked to a new multi-stage attack chain that leads to the deployment of the NjRAT remote access trojan on compromised systems. "The group is known for using a variety of sophisticated attack techniques, including custom malware, social...

CVE-2023-29110: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The SAP Application Interface Message Dashboard - versions AIF 703, AIFX 702, S4CORE 100, 101, SAPBASIS 755, 756, SAPABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker...

Siemens OPC Foundation Local Discovery Server Affecting Siemens Products

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

CVE-2020-20913

SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basictitle parameter...

MCMS SQL injection vulnerability

MingSoft MCMS is a complete open source J2ee system from MingSoft, China. A security vulnerability exists in MCMS v.4.7.2. An attacker can exploit this vulnerability to execute arbitrary code via the basictitle parameter...

CVE-2023-1013

CVE-2023-1013 affects Virames Vira-Investing prior to 1.0.84.86. The issue is an Improper Neutralization of Script-Related HTML Tags in web pages, enabling a basic Cross-Site Scripting (XSS) vulnerability. Affected product: Virames Vira-Investing (versions before 1.0.84.86). Underlying cause: imp...

Boa Web Server v0.94.14 - Authentication Bypass

Exploit Title: Boa Web Server v0.94.14 - Authentication Bypass Date: 19-11-2022 Exploit Author: George Tsimpidas Vendor: https://github.com/gpg/boa CVE: N/A Tested on: Debian 5.18.5 Description : Boa Web Server Versions from 0.94.13 - 0.94.14 fail to validate the correct security constraint on th...

ThinkPad BIOS Code Execution

The vulnerability of the BIOS microprogramming system in ThinkPad laptops exists due to a flaw in the mechanism for detecting unauthorized access to the BIOS. Exploiting this vulnerability can allow an intruder to execute arbitrary code...