CVE-2023-36575 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

...

A malicious user can avoid unfavorable score updates after alpha/multiplier changes, resulting in accrual of outsized rewards for the attacker at the expense of other users

Lines of code Vulnerability details Note All functions/properties referred to are in the Prime.sol contract. Impact A malicious user can accrue outsized rewards at the expense of other users after updateAlpha or updateMultipliers is called. Proof of Concept An attacker can prevent their score fro...

CVE-2023-43892

Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This vulnerability is exploited via a crafted payload...

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server, related to improper cleaning or release of resources, allows a perpetrator to cause service failures.

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

Mitigating Risk with Custom First-Party Software and Application Components: A CISOs’ Guide

What is First-Party Software Anyway? First-party software, unlike off-the-shelf ‘Third-Party’ software, is custom open-source software OSS and applications created by organizations to stitch together existing software to meet custom business needs. Nearly every company today uses some form of...

The vulnerability of Google Chrome’s user tabs allows a hacker to replace the user’s interface.

The vulnerability of Google Chrome’s user tabs is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a malicious actor to replace the user interface with a specially created HTML page...

Drupal Releases Security Advisory to Address Vulnerability in Drupal Core

Drupal has released a security advisory to address a vulnerability affecting multiple Drupal versions. A malicious cyber actor could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review Drupal security advisory SA-CORE- 2023-006link ...

The vulnerability of the Windows operating system’s kernel allows attackers to enhance their privileges.

The vulnerability of Windows operating system kernels is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2023-36744

creationtimestamp| type| source ---|---|--- 2023-09-12 20:29:25+00:00| seen| https://t.me/cibsecurity/70333 2024-09-19 18:02:10+00:00| seen| https://www.thezdi.com/blog/2024/9/18/exploiting-exchange-powershell-after-proxynotshell-part-3-dll-loading-chain-for-rce 2026-07-26 07:01:24+00:00| seen|...

Google Android elevation of privilege vulnerability (CNVD-2024-13716)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain elevated privileges...

Potential Over-redemption Vulnerability in redeem Function

Lines of code Vulnerability details Impact In the redeem function, when a third party is using their allowance to redeem shares on behalf of an owner, there exists a potential scenario where the third party could redeem more than originally intended by the owner. Proof of Concept This is how the...

CVE-2023-3899

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the...

PT-2023-27248 · Elecom · Elecom Wireless Access Points

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN access point devices affected versions not specified WAB-S600-PS all versions WAB-S300 all versions Description: The issue allows an authenticated user to execute an arbitrary OS command by sending a specially crafted...

CVE-2023-36844

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables...

Google Android Information Disclosure Vulnerability (CNVD-2024-07851)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Google Android Information Disclosure Vulnerability (CNVD-2024-07852)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

CVE-2023-39394

Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this vulnerability may cause the arp list to be modified...

CVE-2023-39381

Input verification vulnerability in the storage module. Successful exploitation of this vulnerability may cause the device to restart...

CVE-2023-39396

Deserialization vulnerability in the input module. Successful exploitation of this vulnerability may affect availability...

ScienceLogic SL1 SQL Injection Vulnerability (CNVD-2023-66413)

ScienceLogic SL1 is an application from ScienceLogic, Inc. Connect your real estate together to automate multidirectional data flow and workflow. A SQL injection vulnerability exists in ScienceLogic SL1 11.1.2 and earlier versions, which stems from a lack of validation of externally entered SQL...