jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name

It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

walkingoncommonground.org Cross Site Scripting vulnerability OBB-3476720

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

2023 CWE Top 25 Most Dangerous Software Weaknesses

The Homeland Security Systems Engineering and Development Institute, sponsored by the Department of Homeland Security and operated by MITRE, has released the 2023 Common Weakness Enumeration CWE Top 25 Most Dangerous Software Weaknesseslink is external. The CWE Top 25 is calculated by analyzing...

CVE-2023-21196

In btmblebatchscanfiltertrackadvvsecback of btmblebatchscan.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for...

CVE-2023-3407

creationtimestamp| type| source ---|---|--- 2023-06-28 07:12:34+00:00| seen| https://t.me/cibsecurity/65596...

ruby/cgi-gem: HTTP response splitting in CGI

A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients...

CVE-2023-3113

An unauthenticated XML external entity injection XXE vulnerability exists in LXCA's Common Information Model CIM server that could result in read-only access to specific files...

Xxe

An unauthenticated XML external entity injection XXE vulnerability exists in LXCA's Common Information Model CIM server that could result in read-only access to specific files...

CVE-2022-48422

creationtimestamp| type| source ---|---|--- 2023-06-26 17:17:14+00:00| published-proof-of-concept| https://t.me/codebysec/7497 2025-02-27 16:26:01+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5706...

CVE-2023-29709

An issue was discovered in /cgi-bin/loginrj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication...

CVE-2023-35810

creationtimestamp| type| source ---|---|--- 2023-06-18 02:24:07+00:00| seen| https://t.me/cibsecurity/65320...

Ubuntu 20.04 LTS : SSSD regression (USN-6156-2)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6156-2 advisory. USN-6156-1 fixed a vulnerability in SSSD. In certain environments, not all packages ended up being upgraded at the same time, resulting in authentication failures...

CVE-2023-2819

creationtimestamp| type| source ---|---|--- 2023-06-15 02:21:08+00:00| seen| https://t.me/cibsecurity/65248...

CVE-2023-34865

creationtimestamp| type| source ---|---|--- 2023-06-14 18:20:49+00:00| seen| https://t.me/cibsecurity/65233...

CVSSv4 Public Preview Announcement

On June 8, 2023, at the 35th Annual FIRST Conference in Montreal, the public preview of CVSSv4 was announced. The Common Vulnerability Scoring System CVSS is an open framework for communicating the characteristics and severity of software vulnerabilities. Since its initial release in 2004, CVSS h...

CVE-2023-29362

Remote Desktop Client Remote Code Execution Vulnerability...

Debian DSA-5424-1 : php7.4 - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5424 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The...

Debian DSA-5425-1 : php8.2 - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5425 advisory. It was discovered that PHP's implementation of SOAP HTTP Digest authentication performed insufficient error validation, which may result in a stack information leak or use...

Remote Code Execution (RCE)

Overview Affected versions of this package are vulnerable to Remote Code Execution RCE. A vulnerability exists in NuGet where a race condition can lead to a symlink attack. Note: Non-Linux platforms are not affected. Remediation Upgrade NuGet.Common to version 5.11.5, 6.0.5, 6.2.4, 6.3.3, 6.4.2,...

UBUNTU-CVE-2023-34095

cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends CPDB project. In versions 1.0 through 2.0b4, cpdb-libs is vulnerable to buffer overflows via improper use of scanf3. cpdb-libs uses the fscanf and scanf functions to parse command lines and configuration...