CVE-2023-41293

Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2023-41293

Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect confidentiality...

Security feature bypass

Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2023-41293

Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2023-41293

Huawei HarmonyOS DDMP 모듈에서 데이터 보안 분류 계층의 취약점이 보고되었습니다. CVE-2023-41293은 DDMP 모듈의 접근 제어 부재로 인해 원격에서 악용될 수 있으며, 확인된 영향은 기밀성의 손상입니다. NVD 메트릭에 따르면 이 취약점의 공격 벡터는 네트워크이며, 공격의 복잡도는 낮고, 필요 권한은 없음, 사용자 상호작용도 필요하지 않습니다. 기밀성에 높은 영향이 확인되지만, 문서에 제시된 구체적 악용 코드나 실전 공격 정보는 제공되지 않습니다. 패치 버전이나 구체적 수정안은 명시적으로 제시되어 있...

PT-2023-28132 · Poll Maker Team · Poll Maker Plugin

Name of the Vulnerable Software and Affected Versions: Poll Maker Team Poll Maker plugin versions = 4.7.0 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

The software for managing medical organizations like OpenEMR is vulnerable due to insufficient verification of input data, allowing attackers to compromise data privacy and integrity.

The software for managing medical organizations called OpenEMR is vulnerable due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise the confidentiality and integrity of data...

Deleted account still has the right to create, delete other accounts (delete surveys)

Description An account that has been deleted still has the right to create, delete surveys other accounts Proof of Concept Video Poc https://drive.google.com/file/d/1kvNqK8tYvWDabLigI6dZsp4kpKKkrfIx/view?usp=sharing...

Apache Druid < 0.22.0 Incorrect Authorization

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...

Huawei EulerOS: Security Advisory for shim (EulerOS-SA-2023-2831)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The Dark Side of Web Development: Why You Should Be Prioritizing Shadow Code

In the fast-paced world of web development, staying ahead of the curve is paramount, as developers are frequently under pressure to deliver products and functionalities quickly and efficiently. To meet accelerated timelines, they often leverage third-party scripts and open-source libraries,...

CVE-2023-42472

CVE-2023-42472 affects SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface (v420). Root cause: insufficient file type validation during image file upload, enabling an authenticated attacker to intercept requests and modify content type/extension to read/modify sensi...

Major cyberattack leaves MGM Resorts reeling

A major incident impacting MGM Resorts has caused computer shutdowns all over the US. The systems most impacted are tied to casinos and hotel computer systems. According to the AP, locations caught by this shutdown range from New York and Ohio to Michigan and Mississippi. At this point Id link to...

PT-2023-5565 · Huawei · Harmonyos +1

Name of the Vulnerable Software and Affected Versions: DDMP module affected versions not specified Description: The issue is related to a data security classification vulnerability in the DDMP module, which may affect confidentiality. Successful exploitation of this vulnerability could allow a...

Cisco HyperFlex HX Data Platform Input Validation Error Vulnerability

The Cisco HyperFlex HX Data Platform is a high-performance, scalable distributed file system that supports a wide range of virtual machine monitoring programs and provides a range of enterprise-class data management and optimization services. An input validation error vulnerability exists in Cisc...

AlmaLinux 8 : firefox (ALSA-2023:4952)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:4952 advisory. - A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing...

PT-2023-27331 · Vathemes · Vathemes Business Pro

Name of the Vulnerable Software and Affected Versions: Vathemes Business Pro theme versions = 1.10.4 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal...

PT-2023-22730 · Imagerecycle · Imagerecycle Pdf & Image Compression Plugin

Name of the Vulnerable Software and Affected Versions: ImageRecycle ImageRecycle pdf & image compression plugin versions = 3.1.10 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

Imperva Clinches 2023 SC Media Trust Award for Best Database Security Solution: A Back-to-Back Victory

Imperva, a global leader in cybersecurity, is proud to announce that we have once again been honored for our industry-leading database security solutions, earning the prestigious 2023 SC Media Trust Award for Best Database Security Solution. This accolade marks the second consecutive year that...

Spoofing

Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data Security Plus 6110 and below, Eventlog Analyzer 12301 and below, Exchange...