CVE-2023-24597

OX App Suite before frontend 7.10.6-rev24 is affected by a vulnerability that allows loading an email messages remote resources during printing without user consent. Root cause: loading remote resources in the print flow (no user interaction). Impact: potential information exposure (confidential...

CVE-2023-24597: Undefined Security Weakness

OX App Suite before frontend 7.10.6-rev24 allows the loading without user consent of an e-mail message's remote resources during printing...

The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System (IGSS), arises from the possibility of unlimited loading of dangerous files, allowing a intruder to execute arbitrary code.

The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System IGSS, lies in its ability to load files of a dangerous type without limitation. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2023-32321

CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in resourcecreate and packageupdate actions, using the ResourceUploader object. Also...

Remote code execution

CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in resourcecreate and packageupdate actions, using the ResourceUploader object. Also...

CVE-2023-32321 CKAN remote code execution and private information access via crafted resource ids

CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in resourcecreate and packageupdate actions, using the ResourceUploader object. Also...

CVE-2023-32321

CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in resourcecreate and packageupdate actions, using the ResourceUploader object. Also...

Design/Logic Flaw

An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web application without any kind of sanitization. This allows injection of arbitrary JavaScript code into image metadata, which is executed when that metadata is...

CVE-2023-32321: Improper Input Validation

CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in resourcecreate and packageupdate actions, using the ResourceUploader object. Also...

N. Korean Lazarus Group Targets Microsoft IIS Servers to Deploy Espionage Malware

The infamous Lazarus Group actor has been targeting vulnerable versions of Microsoft Internet Information Services IIS servers as an initial breach route to deploy malware on targeted systems. The findings come from the AhnLab Security Emergency response Center ASEC, which detailed the advanced...

N. Korean Lazarus Group Targets Microsoft IIS Servers to Deploy Espionage Malware

The infamous Lazarus Group actor has been targeting vulnerable versions of Microsoft Internet Information Services IIS servers as an initial breach route to deploy malware on targeted systems. The findings come from the AhnLab Security Emergency response Center ASEC, which detailed the advanced...

Privilege escalation

Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office Windows before build 40208...

Escalating China-Taiwan Tensions Fuel Alarming Surge in Cyber Attacks

The rising geopolitical tensions between China and Taiwan in recent months have sparked a noticeable uptick in cyber attacks on the East Asian island country. "From malicious emails and URLs to malware, the strain between China's claim of Taiwan as part of its territory and Taiwan's maintained...

Escalating China-Taiwan Tensions Fuel Alarming Surge in Cyber Attacks

The rising geopolitical tensions between China and Taiwan in recent months have sparked a noticeable uptick in cyber attacks on the East Asian island country. "From malicious emails and URLs to malware, the strain between China's claim of Taiwan as part of its territory and Taiwan's maintained...

Local privilege escalation due to unrestricted loading of unsigned libraries

...

orbit:ElfFileLoadSymbolsFuzzer: Heap-buffer-overflow in orbit_object_utils::ElfFileImpl<llvm::object::ELFType<

Detailed Report: https://oss-fuzz.com/testcase?key=4583810308374528 Project: orbit Fuzzing Engine: libFuzzer Fuzz Target: ElfFileLoadSymbolsFuzzer Job Type: libfuzzerasanorbit Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6120000073c1 Crash State:...

CVE-2023-2745

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wplang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such ...

OpenJDK: soundbank URL remote loading (Sound, 8293742)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Sound. Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploi...

RHEL 9 : nodejs:18 (RHSA-2023:2654)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2654 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

vulkan-loader:json_load_fuzzer: Heap-buffer-overflow in parse_string

Project: https://github.com/khronosgroup/Vulkan-Loader.git Detailed Report: https://oss-fuzz.com/testcase?key=4512865114259456 Project: vulkan-loader Fuzzing Engine: afl Fuzz Target: jsonloadfuzzer Job Type: aflasanvulkan-loader Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash...