17607 matches found
Default credentials
An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released...
CVE-2023-49923
Elastic App Search’s Documents API logged raw indexed document contents at INFO, risking leakage of sensitive data in logs. Affected versions: Enterprise Search/App Search before 7.17.16 and before 8.11.2. Root cause: logging those contents at INFO; fix: log at DEBUG (disabled by default) in 7.17...
CVE-2023-46219
The CVE-2023-46219 entry concerns curl failing to preserve HSTS data when saving to an excessively long filename, which can cause curl to lose HSTS status for subsequent requests that rely on it. The issue is triggered by writing HSTS data to an overly long file path, resulting in removal of file...
CVE-2023-42894
CVE-2023-42894 describes a privacy flaw in macOS where an app may access information about a user’s contacts. The issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, and macOS Monterey 12.7.2. CVSSv3.1 metrics indicate a Local attack vector, requiring user interaction, with High confidenti...
CVE-2023-26920
CVE-2023-26920 affects the fast-xml-parser library (before 4.1.2). The issue is a Prototype Pollution flaw triggered by proto and can lead to remote code execution or denial of service, per IBM’s Cloud Pak for Data advisory (affecting 4.0.0–4.8.4; remediation to 4.8.5). NVD lists CVSSv3.1 base sc...
CVE-2023-36648
The CVE-2023-36648 issue affects ProLion CryptoSpike 3.0.15P2, where missing authentication in the internal data streaming system allows remote unauthenticated access to Apache Kafka as a consumer or producer. This exposes potentially sensitive information and can cause denial of service by direc...
CVE-2023-36649
ProLion CryptoSpike 3.0.15P2 is affected by an authentication/authorization issue arising from insertion of sensitive information into the centralized Grafana logging system, enabling remote attackers to impersonate other users in web management and REST API by reading JWT tokens from logs or the...
Webinar — Psychology of Social Engineering: Decoding the Mind of a Cyber Attacker
In the ever-evolving cybersecurity landscape, one method stands out for its chilling effectiveness – social engineering. But why does it work so well? The answer lies in the intricate dance between the attacker's mind and human psychology. Our upcoming webinar, "Think Like a Hacker, Defend Like a...
CVE-2023-40238
creationtimestamp| type| source ---|---|--- 2023-12-11 10:24:17+00:00| exploited| https://t.me/cultofwire/1146 2023-12-30 10:36:41+00:00| seen| https://t.me/ctinow/160847 2024-01-05 18:31:37+00:00| seen| https://t.me/ctinow/163626 2024-12-03 11:01:07+00:00| seen|...
CVE-2023-48399
CVE-2023-48399 describes an out-of-bounds read in ProtocolMiscATCommandAdapter::Init() (protocolmiscadapter.cpp) due to a missing bounds check. This can lead to local information disclosure and requires baseband firmware compromise for exploitation; no user interaction is needed. Multiple connect...
CVE-2023-6245
The CVE-2023-6245 issue affects the Candid library used by Rust candid decoder. A specially crafted payload exploiting the data type empty can cause an infinite decoding loop, effectively triggering a Denial of Service as decoding runs until the execution round instruction limit is reached. Motok...
CVE-2023-46454
creationtimestamp| type| source ---|---|--- 2023-12-08 01:48:35+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/6110 2024-01-02 14:36:32+00:00| seen| https://t.me/ctinow/161789 2024-03-03 15:14:53+00:00| published-proof-of-concept| https://t.me/VulnerabilityNews/35408 2024-03-03...
CVE-2023-46495
CVE-2023-46495 describes a Cross Site Scripting vulnerability in EverShop NPM prior to version 1.0.0-rc.8. A remote attacker can obtain sensitive information by crafting requests to the sortBy parameter. The connected records consistently identify the affected product as EverShop NPM and indicate...
CVE-2023-4122
CVE-2023-4122 affects Student Information System v1.0, with an Insecure File Upload vulnerability on the photo parameter of the my-profile page. The underlying issue allows an authenticated attacker to achieve Remote Code Execution on the server hosting the application. Evidence from multiple con...
CVE-2023-46218
CVE-2023-46218 affects curl and stems from a mixed-case domain verification flaw against the PSL. This can let a malicious HTTP server set “super cookies” that may be sent to unrelated origins, exploiting domain comparisons such as domain=co.UK with a curl.co.uk URL. The vulnerability is describe...
CVE-2023-43304
Vulnerability CVE-2023-43304 affects LINE’s PARK DANDAN mini-app on Line v13.6.1. The issue allows an attacker to send crafted malicious notifications through leakage of the channel access token, enabling unauthorized notifications without user interaction. The root cause is token leakage within ...
CVE-2023-48207
CVE-2023-48207 affects PHPJabbers Availability Booking Calendar version 5.0. The vulnerability arises from insufficient input validation in the unique ID field used to build CSV exports from the Reservations list component, enabling CSV injection. Public sources describe potential remote code exe...
CVE-2023-26154
CVE-2023-26154 corresponds to an Insufficient Entropy vulnerability in PubNub crypto, caused by the AES-256-CBC implementation’s insecure entropy/ key handling. Affected packages include PubNub core libraries across multiple languages (pubnub, com.pubnub:pubnub, github.com/pubnub/go and variants)...