Upgrading your Android device? Read this first

Last month, we wrote an article about what to do when upgrading your iPhone. Since then, we've received several requests to do a similar post about Android devices. Providing uniform and easy to follow instructions is a bit harder to do for Android, because there are many differences between make...

Progress Software WS_FTP Server Security Vulnerability

Progress Software WSFTP Server is an effective and highly manageable FTP server from Progress Software, USA. A security vulnerability exists in Progress Software WSFTP Server versions prior to 8.8.2. An attacker can use this vulnerability to enumerate files in the "WebServiceHost" directory listi...

TP-LINK Archer C1200 OS Command Injection Vulnerability

The TP-LINK Archer C1200 is a wireless router from China P&L TP-LINK. A security vulnerability exists in firmware versions prior to TP-LINK Archer C1200JPV2230508, Archer C9JPV3230508, and Archer C9JPV3230508, which stems from a vulnerability that could allow a network-adjacent authenticated...

Splunk 访问控制错误漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

Unverified password change : old password can be used as new password

Description Pimcore Platform v 11.0.7 is not enforcing strict password policy which allow attacker to set old password as new password Proof of Concept 1- go to https://demo.pimcore.com/admin/login 2- login with demo user credentials Username: superuser Password: enterprisedemo 3- Now login and...

Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities

A unified front against malicious cyber actors is climactic in the ever-evolving cybersecurity landscape. The joint Cybersecurity Advisory CSA, a collaboration between leading cybersecurity agencies from the United States, Canada, United Kingdom, Australia, and New Zealand, is a critical guide to...

PT-2023-20604 · Oppo · Oppo Find X3 +1

Name of the Vulnerable Software and Affected Versions: mobile phone backup app affected versions not specified Description: There is a command injection problem in the old version of the mobile phone backup app. Recommendations: At the moment, there is no information about a newer version that...

WordPress plugin WP Ultimate CSV Importer Code Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).

...

Kirby 代码问题漏洞

Kirby is a file-based content management system CMS. A code issue vulnerability exists in Kirby versions 3.5.8.2 and earlier, 3.6.0 through 3.6.6.2, 3.7.0 through 3.7.5.1, 3.8.0 through 3.8.4, and 3.9.0 through 3.9.5, which arises from a change in a user's password by a user or site administrator...

CVE-2023-37919 Cal.com not expiring old sessions after enabling 2FA

Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other devices stays logged ...

Cal.com 代码问题漏洞

Cal.com is an open source scheduling software from Cal.com Open Source. A code issue vulnerability exists in Cal.com that stems from old sessions not expiring when 2FA is enabled...

WordPress Tweet Old Custom Post Plugin <= 19.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Tweet Old Custom Post Type Plugin Vulnerable versions = 19.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 052dae11c71c Credits Rafie Muhammad Patchstack...

WordPress Delete old Posts automatically Plugin < 3.3.9 is vulnerable to Cross Site Scripting (XSS)

Software Delete old Posts automatically Type Plugin Vulnerable versions 3.3.9 Fixed in 3.3.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 46270e2e981b Credits Rafie Muhammad...

CVE-2023-38409

An issue was discovered in setcon2fbmap in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbconregisteredfb and fbcondisplay arrays can be desynchronized in fbconmodedeleted the con2fbmap points at the old fbinfo...

UBUNTU-CVE-2023-38409

An issue was discovered in setcon2fbmap in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbconregisteredfb and fbcondisplay arrays can be desynchronized in fbconmodedeleted the con2fbmap points at the old fbinfo...

PT-2023-25374 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue is related to Mattermost failing to invalidate previously generated password reset tokens when a new reset token is created. This allows potentially unauthorized access through...

Old certificate, new signature: Open-source tools forge signature timestamps on Windows drivers

Cisco Talos has observed threat actors taking advantage of a Windows policy loophole that allows the signing and loading of cross-signed kernel mode drivers with signature timestamp prior to July 29, 2015. Actors are leveraging multiple open-source tools that alter the signing date of kernel mode...

WordPress plugin Float menu 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-25122

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...