CVE-2023-46725

CVE-2023-46725 affects FoodCoopShop open‑source software. Versions 3.2.0 up to 3.6.0 are vulnerable to server‑side request forgery via the Network module: an attacker with a manufacturer account can abuse the /api/updateProducts.json endpoint to cause the server to proxy requests to an arbitrary ...

CVE-2023-26454

CVE-2023-26454 affects the Open-Xchange App Suite imageconverter service. The vulnerability allows injecting and executing arbitrary SQL via requests that fetch image metadata, with the attacker needing access to adjacent networks (not exposed to the public Internet by default). Arbitrary SQL sta...

CVE-2023-26452

Open-Xchange App Suite's imageconverter service is affected by an SQL injection vulnerability triggered when caching an image and returning its metadata, allowing arbitrary SQL statements to execute in the service DB user context. Exploitation requires access to adjacent networks (not exposed pub...

Improper access control

Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access control list ACL and allow traffic that should be denied to flo...

Zero Day Threat Protection for Your Network

Explore the world of zero day threats and gain valuable insight into the importance of proactive detection and remediation...

XDR vs. SIEM

Enhanced Discovery and Resolution, or more commonly known as XDR, serves as a revolutionary model in cybersecurity. It works by combining multiple security apparatuses into a solitary system, thus uplifting the ability for threat detections and subsequent responses. Unlike the standard...

CVE-2023-41721

Instances of UniFi Network Application that i are run on a UniFi Gateway Console, and ii are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to t...

UBUNTU-CVE-2023-5388

NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9...

Qixingchen Tianyue Network Security Audit System-Internet Behavior Control Exists Information Leakage Vulnerability

Internet Behavior Manager IBM, a new-generation high-performance Internet behavior management product, is equipped with the functions of integrated network access, control, optimization, audit and operation. There is an information leakage vulnerability in Qixingchen Tianyue Network Security Audi...

CVE-2023-23373

CVE-2023-23373 relates to an OS command injection in QNAP’s QUSBCam2. Affected versions are those prior to 2.0.3; exploitation could allow remote command execution over the network. The vulnerability root cause is not expanded beyond “OS command injection” in the provided documents, but multiple ...

NSS PKCS#1 v1.5 Bleichenbacher Marvin

The vulnerability of the PKCS1 v1.5 standard implemented by the NSS Network Security Services library is related to insufficient protection of service data due to timing discrepancies. Exploiting this vulnerability allows a remote attacker to execute the Bleichenbacher attack or the Marvin attack...

CVE-2023-41088

CVE-2023-41088 affects DexGate/Dexma DexGate devices. The vulnerability is a cleartext transmission of sensitive information, allowing an attacker with network access to capture traffic between clients and the DexGate server, potentially exposing credentials or other sensitive data. Public detail...

CVE-2023-22105

Oracle BI Publisher in Oracle Analytics (Web Server component) is affected by CVE-2023-22105 for versions 6.4.0.0.0 and 7.0.0.0.0. The issue allows a low-privileged, network-access attacker (via HTTP) to compromise BI Publisher, with required user interaction, potentially leading to unauthorized ...

CVE-2023-45871

An issue was discovered in drivers/net/ethernet/intel/igb/igbmain.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU...

SUSE CVE-2023-5388

NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9...

CVE-2023-34977

The CVE-2023-34977 entry describes a cross‑site scripting (XSS) vulnerability affecting QNAP Video Station. The issue could allow authenticated users to inject malicious code over the network. The vulnerability is fixed in Video Station 5.7.0 and later (released 2023‑07‑27). According to the prov...

FBI, CISA Warn of Rising AvosLocker Ransomware Attacks Against Critical Infrastructure

The AvosLocker ransomware gang has been linked to attacks against critical infrastructure sectors in the U.S., with some of them detected as recently as May 2023. That's according to a new joint cybersecurity advisory released by the U.S. Cybersecurity and Infrastructure Security Agency CISA and...

Fortinet FortiAnalyzer Data Forgery Issue Vulnerability

Fortinet FortiAnalyzer is a set of centralized network security reporting solutions from the U.S. company Fiat Fortinet. The product is mainly used to collect network log data, and through the reporting suite of security events in the log, network traffic, Web content, etc. to analyze, report,...

Fortinet FortiOS Access Control Error Vulnerability (CNVD-2023-98189)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An Access Control Error...

CVE-2023-44191

CVE-2023-44191 – Juniper Junos OS DoS on large VLAN deployments (QFX5000/EX4000) Root cause: An Allocation of Resources Without Limits or Throttling vulnerability in Junos OS allows an unauthenticated, network-based attacker to trigger Denial of Service via a specific DHCP packet when many VLANs ...