Patch CVE-2023-23397 Immediately: What You Need To Know and Do

We break down the basic information of CVE-2023-23397, the zero-day, zero-touch vulnerability that was rated 9.8 on the Common Vulnerability Scoring System CVSS scale...

CVE-2022-45124

CVE-2022-45124 affects WellinTech KingHistorian 35.01.00.05. Cisco Talos reports an information-disclosure vulnerability in the User authentication path: if an attacker captures an authentication packet, they can recover the username and password, exposing sensitive data. CVSSv3.1 base score 7.5 ...

CVE-2023-1500

CVE-2023-1500 affects code-projects Simple Art Gallery 1.0. Affected is the file adminHome.php where manipulation of the parameter about_info enables a cross-site scripting (XSS) . The issue is exploitable remotely, with public disclosure of the exploit reported in multiple sources. The CVE entri...

CVE-2023-26606

In the Linux kernel 6.0.8, there is a use-after-free in ntfstrimfs in fs/ntfs3/bitmap.c...

CVE-2023-1152 SQLi in Utarit Persolus

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Utarit Information Technologies Persolus allows SQL Injection. This issue affects Persolus: before 2.03.93...

CVE-2023-28531

creationtimestamp| type| source ---|---|--- 2023-03-17 06:31:14+00:00| seen| https://t.me/cibsecurity/60220 2024-01-26 23:00:49+00:00| seen| https://t.me/arpsyndicate/3105 2025-04-01 08:49:50+00:00| published-proof-of-concept| https://t.me/MalaysiaHacktivistz/2962 2025-04-01 08:49:50+00:00|...

CVE-2023-1436

CVE-2023-1436 : Jettison triggers an infinite recursion when constructing a JSONArray from a Collection containing a self-reference, leading to a DoS/StackOverflow in vulnerable deployments. Connected IBM advisories tie this to IBM watsonx.data and list remediation: upgrade to watsonx.data 2.0.3 ...

Microsoft SharePoint Server Spoofing Vulnerability (CNVD-2023-72200)

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A spoofing...

CVE-2023-28486

CVE-2023-28486 affects the sudo utility; the affected component is sudo prior to version 1.9.13, which does not escape control characters in log messages. Multiple connected advisories confirm the issue and subsequent fixes across distributions (e.g., Debian LTS advisory DLA-4472-1 for sudo 1.9.5...

CVE-2020-22647

The CVE-2020-22647 entry concerns DepositGame v1.0, where the GetBonusWithdraw and withdraw functions allow an attacker to gain sensitive information (information disclosure). The issue is described consistently across multiple sources (DepositGame v1.0, GetBonusWithdraw, and withdraw), but expli...

CVE-2023-22876

IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0–6.0.3.7 and 6.1.0.0–6.1.2.1 are affected by an information-disclosure vulnerability (CVE-2023-22876) that could allow a privileged user to obtain sensitive data. The issue is addressed by upgrades: apply 6.0.3.8 for the 6.0.x line and ...

CVE-2023-24730

CVE-2023-24730 affects Simple Customer Relationship Management System v1.0. The issue is a SQL injection in the user profile update function via the company parameter, enabling potentially full data compromise (CVSS v3.1 base score 8.8: Confidentiality, Integrity, Availability all High). Connecte...

CVE-2023-27270

SAP NetWeaver Application Server for ABAP and ABAP Platform (versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791) is affected by a Denial of Service vulnerability where an attacker authenticated as a non-administrative user can craft a request with specific parameters to...

KLA48561 Multiple vulnerabilities in Microsoft Dynamics

Multiple vulnerabilities were found in Microsoft Dynamics 365. Malicious users can exploit these vulnerabilities to spoof user interface, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Security UI vulnerability in Microsoft Dynamics 365 on-premises can be exploited...

MAL-2023-5343 Malicious code in py-mcultracraft (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 05f872d3d839e83f4cfa6a29e16e93759396a58f0bb74d8f93ec8f14420b0a40 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6996 Malicious code in tpcvurlpong (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 001eabd8aa23a93db2f17fe69268f9eba2dece879e5cde7dbc93297d6d6279f6 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

CVE-2021-27788

HCL Verse is affected by a Cross-Site Scripting (XSS) vulnerability exploitable by tricking a user into clicking a crafted URL. The vulnerability could allow an attacker, without authentication, to run scripts in the victim’s browser and potentially steal cookies, session tokens, or other sensiti...

MAL-2023-3386 Malicious code in esqrestrhttp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 002e6ecef51a256f5d525484f590c55ebb047ffba211e6cb52a3e6c8bd90c9ef EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

From Pod Security Policies to Pod Security Standards – a Migration Guide

Pod Security Policies were removed in Kubernetes v1.25 — learn how to migrate from Pod Security Policies to Pod Security Standards...

owohho.com Open Redirect vulnerability OBB-3214668

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...