NIST Draft Document on Post-Quantum Cryptography Guidance

NIST has released a draft of Special Publication1800-38A: "Migration to Post-Quantum Cryptography: Preparation for Considering the Implementation and Adoption of Quantum Safe Cryptography." Its only four pages long, and it doesnt have a lot of detail--more "volumes" are coming, with more...

CVE-2023-2445

Summary of CVE-2023-2445 (Devolutions Server) Affected software: Devolutions Server, versions 2023.1.1 and earlier. Vulnerability: Improper access control in the Subscriptions Folder path filter. This allows attackers with administrator privileges to retrieve usage information about folders in a ...

CVE-2023-31207

CVE-2023-31207 affects Checkmk; multiple connected sources confirm that transmitting credentials within query parameters can cause the automation user’s secret to be written to the site Apache access log. Affected streams include Checkmk versions ≤ 2.1.0p26, ≤ 2.0.0p35, and ≤ 2.2.0b6 (beta). The ...

CVE-2023-29867

Zammad 5.3.x Fixed 5.4.0 is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved in their tickets using the Zammad API...

CVE-2023-31435

CVE-2023-31435 – Evasys vulnerability (normal mode) Affected product: evasys (versions prior to 8.2 Build 2286 and 9.x prior to 9.0 Build 2401). Root cause / description: Multiple components (e.g., Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, questionnaire previews) all...

The High-Stakes Scramble to Stop Classified Leaks

AI tools? A porn filter, but for Top Secret documents? Just classifying less stuff? US lawmakers are full of ideas but lack a silver bullet...

PUB-A-258053342

Bulletin has no description...

CVE-2022-41398

creationtimestamp| type| source ---|---|--- 2023-04-28 16:27:20+00:00| seen| https://t.me/cibsecurity/63044 2025-02-01 17:28:11+00:00| seen| Telegram/mj4u6vRN8WHQpoJCrqyLu358eR2YvjDgJFTkKgQopx35gIQf...

Why you should practice rollbacks to prevent data loss in a ransomware attack

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Tanya Janca, Founder...

CVE-2023-28770

CVE-2023-28770 affects Zyxel DX5401-B0 firmware prior to V5.17(ABYO.1)C0. The issue arises from sensitive information exposure via CGI Export_Log and the zcmd binary, allowing a remote unauthenticated attacker to read system files and retrieve the supervisor password from an encrypted file. Publi...

CVE-2023-20853

The CVE-2023-20853 entry concerns aDeserialization of Untrusted Data in the aEnrich Technology a+HRD MSMQ asynchronous message processing. An unauthenticated remote attacker could trigger arbitrary command execution and disrupt services via deserialization of untrusted data. Affected component: M...

Code injection

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file...

CVE-2023-30266

creationtimestamp| type| source ---|---|--- 2023-04-26 18:26:05+00:00| seen| https://t.me/cibsecurity/62905...

CVE-2023-2281 Archiving a team broadcasts unsanitized data over WebSockets

When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team...

Wondershare Filmora 12.2.9.2233 - Unquoted Service Path

Exploit Title: Wondershare Filmora 12.2.9.2233 - Unquoted Service Path Date: 2023/04/23 Exploit Author: msd0pe Vendor Homepage: https://www.wondershare.com My Github: https://github.com/msd0pe-1 Wondershare Filmora: Versions = wmic service get name,pathname,displayname,startmode | findstr /i auto...

CVE-2023-24512

The CVE-2023-24512 issue affects Arista EOS running with the Streaming Telemetry Agent (TerminAttr) enabled and gNMI access configured. An authorized attacker with gNMI permissions could craft a request to update arbitrary switch configurations, under conditions where TerminAttr is present and gR...

CVE-2023-30410

CVE-2023-30410 : A stack overflow was found in JerryScript in the function construct code path, specifically in the ecma_op_function_construct component at /operations/ecma-function-object.c. The vulnerability is documented against commit 1a2c047 of JerryScript and is reported as affecting that c...

Embracing Change with Akamai Connected Cloud

...

CVE-2023-2226

The CVE-2023-2226 issue affects Velociraptor (Rapid7 Velociraptor) prior to version 0.6.8. Root cause: insufficient validation in the PE and OLE parsers, allowing a specially crafted malicious file to cause the Velociraptor service to crash during artifact parsing. Impact: DoS via crash with the ...

GHSA-G66V-3V62-G375 RosarioSIS improper access control vulnerability

RosarioSIS prior to version 10.9.3 has a vulnerability that allows a user to return to a page containing personally identifiable information PII and sensitive information even after logging out of the application by using the browser's back button...