PT-2023-25612

Name of the Vulnerable Software and Affected Versions Digital Ant E-Commerce Software versions prior to 11 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker ca...

CVE-2023-3651: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Digital Ant E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 11...

PT-2023-25606

Name of the Vulnerable Software and Affected Versions Digital Ant E-Commerce Software versions prior to 11 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker c...

Digital Ant E-Commerce Cross-Site Scripting Vulnerability

Digital Ant E-Commerce is an e-commerce platform from Digital Ant, Inc. A cross-site scripting vulnerability exists in versions of Digital Ant E-Commerce Software prior to version 11, which arises from improperly neutralized input during web page generation...

PT-2023-25601

Name of the Vulnerable Software and Affected Versions Digital Ant E-Commerce Software versions prior to 11 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

Digital Ant E-Commerce Cross-Site Scripting Vulnerability

Digital Ant E-Commerce is an e-commerce platform from Digital Ant, Inc. A cross-site scripting vulnerability exists in versions of Digital Ant E-Commerce Software prior to version 11, which arises from improperly neutralized input during web page generation...

The end looms for Meta's behavioural advertising in Europe

The EU is going toe to toe with Meta once more, with the social network giant conceding defeat yet again. After having taken Meta to task for various privacy violations and data breaches, Meta is now having to provide European users with a way to opt out of behavioural advertising. The threat of...

CVE-2023-38708 Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction

Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the AssetController::importServerFilesAction, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcorelog...

The Need for Trustworthy AI

If you ask Alexa, Amazons voice assistant AI system, whether Amazon is a monopoly, it responds by saying it doesnt know. It doesnt take much to make it lambaste the other tech giants, but its silent about its own corporate parents misdeeds. When Alexa responds in this way, its obvious that it is...

Western Digital MyCloud Unauthenticated Command Injection Exploit

This Metasploit module exploits authentication bypass CVE-2018-17153 and command injection CVE-2016-10108 vulnerabilities in Western Digital MyCloud before 2.30.196 in order to achieve unauthenticated remote code execution as the root user. The module first performs a check to see if the target i...

Patchwork Hackers Target Chinese Research Organizations Using EyeShell Backdoor

Threat actors associated with the hacking crew known as Patchwork have been spotted targeting universities and research organizations in China as part of a recently observed campaign. The activity, according to KnownSec 404 Team, entailed the use of a backdoor codenamed EyeShell. Patchwork, also...

Western Digital MyCloud Unauthenticated Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Western Digital MyCloud unauthenticated command injection', 'Description' = %q This module exploits authentication bypass CVE-2018-17153 and...

Omeka S 跨站脚本漏洞

Omeka S is an open source web content management system CMS from Omeka, Inc. that specializes in creating and managing digital exhibitions and online digital archives. It is a new version of the Omeka project, and unlike the traditional Omeka Classic, Omeka S emphasizes multi-user collaboration a...

Cisco NX-OS CLI Command Software Image Signature Verification (CVE-2019-1811)

A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not...

Cisco NX-OS Software Image Signature Verification (CVE-2019-1615)

A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability is due to improper verification of digital signature...

Cisco NX-OS CLI Command Software Image Signature Verification (CVE-2019-1813)

A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not...

Cisco Nexus 7000/7700 Series Switches Software Patch Signature Verification (CVE-2019-1808)

A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signature...

Cisco NX-OS CLI Command Software Image Signature Verification (CVE-2019-1812)

A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not...

CVE-2023-34625

ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mechanism via Bluetooth Low Energy BLE is vulnerable to replay attacks. A malicious user is able to intercept BLE requests and replicate them to open the lock at any time...

CVE-2023-34625

ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mechanism via Bluetooth Low Energy BLE is vulnerable to replay attacks. A malicious user is able to intercept BLE requests and replicate them to open the lock at any time...