What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-03-17 15:09:25 | Organiser la cyber résilience : l\'UE et les États-Unis au diapason (lien direct) | Tandis que les tensions géopolitiques s'accentuent, l'UE et les États-Unis veulent renforcer leurs moyens au service de la de cyber résilience et favoriser la coopération entre secteurs public et privé. | Guideline | ★★★ | |
 |
2023-03-17 14:13:53 | L\'OSINT pour démystifier les attaques de logiciels espions (lien direct) | Retrouver notre série dédiée aux grandes enquêtes qui ont fait sortir de l'ombre l'OSINT (Open Source Intelligence). Dans cet article, l'aventure humaine du groupe de chercheurs en sécurité informatique appelé Security Without Borders et les méthodes d'OSINT pour enquêter sur des attaques de logicie... | Guideline | ★★★ | |
 |
2023-03-17 12:15:12 | CVE-2023-1466 (lien direct) | A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(SLEEP(5)))FWlC) AND 'butz'='butz leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223325 was assigned to this vulnerability. | Vulnerability Guideline | ||
|
2023-03-17 12:15:12 | CVE-2023-1468 (lien direct) | A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&date_from=2023-02-17&date_to=2023-03-17 of the component Report Handler. The manipulation of the argument date_from/date_to leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-223327. | Vulnerability Guideline | ||
|
2023-03-17 12:15:12 | CVE-2023-1467 (lien direct) | A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223326 is the identifier assigned to this vulnerability. | Vulnerability Guideline | ||
|
2023-03-17 12:15:11 | CVE-2023-1464 (lien direct) | A vulnerability, which was classified as critical, was found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file Users.php?f=save_user. The manipulation of the argument firstname/middlename/lastname/username/password leads to improper authentication. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-223311. | Vulnerability Guideline | ||
|
2023-03-17 09:15:12 | CVE-2023-1461 (lien direct) | A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of the file createCategories.php. The manipulation of the argument categoriesStatus leads to sql injection. The attack can be initiated remotely. VDB-223306 is the identifier assigned to this vulnerability. | Vulnerability Guideline | ||
|
2023-03-17 08:15:10 | CVE-2023-1460 (lien direct) | A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=save_user of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The identifier VDB-223305 was assigned to this vulnerability. | Vulnerability Guideline | ||
|
2023-03-17 08:15:09 | CVE-2023-1459 (lien direct) | A vulnerability was found in SourceCodester Canteen Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file changeUsername.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223304. | Vulnerability Guideline | ||
 |
2023-03-17 07:22:00 | APT Profile: Cozy Bear / APT29 (lien direct) | >Advanced Persistent Threat (APT) groups are widely classified as organizations that lead “attacks on a... | Threat Guideline | APT 29 APT 29 | ★★ |
|
2023-03-17 07:15:13 | CVE-2023-1453 (lien direct) | A vulnerability was found in Watchdog Anti-Virus 1.4.214.0. It has been rated as critical. Affected by this issue is some unknown functionality in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-223298 is the identifier assigned to this vulnerability. | Vulnerability Guideline | ||
|
2023-03-17 07:15:13 | CVE-2023-1455 (lien direct) | A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file admin/ajax.php?action=login2 of the component Login Page. The manipulation of the argument email with the input abc%40qq.com' AND (SELECT 9110 FROM (SELECT(SLEEP(5)))XSlc) AND 'jFNl'='jFNl leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223300. | Vulnerability Guideline | ||
|
2023-03-17 07:15:13 | CVE-2023-1454 (lien direct) | A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299. | Vulnerability Guideline | ||
|
2023-03-17 07:15:12 | CVE-2023-1449 (lien direct) | A vulnerability has been found in GPAC 2.3-DEV-rev35-gbbca86917-master and classified as problematic. This vulnerability affects the function gf_av1_reset_state of the file media_tools/av_parsers.c. The manipulation leads to double free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-223294 is the identifier assigned to this vulnerability. | Vulnerability Guideline | ||
|
2023-03-17 07:15:12 | CVE-2023-1448 (lien direct) | A vulnerability, which was classified as problematic, was found in GPAC 2.3-DEV-rev35-gbbca86917-master. This affects the function gf_m2ts_process_sdt of the file media_tools/mpegts.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-223293 was assigned to this vulnerability. | Guideline | ||
|
2023-03-17 07:15:12 | CVE-2023-1451 (lien direct) | A vulnerability was found in MP4v2 2.1.2. It has been classified as problematic. Affected is the function mp4v2::impl::MP4Track::GetSampleFileOffset of the file mp4track.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223296. | Vulnerability Guideline | ||
|
2023-03-17 07:15:12 | CVE-2023-1452 (lien direct) | A vulnerability was found in GPAC 2.3-DEV-rev35-gbbca86917-master. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file filters/load_text.c. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-223297 was assigned to this vulnerability. | Vulnerability Guideline | ||
|
2023-03-17 07:15:12 | CVE-2023-1450 (lien direct) | A vulnerability was found in MP4v2 2.1.2 and classified as problematic. This issue affects the function DumpTrack of the file mp4trackdump.cpp. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223295. | Vulnerability Guideline | ||
|
2023-03-17 07:15:11 | CVE-2023-1446 (lien direct) | A vulnerability classified as problematic was found in Watchdog Anti-Virus 1.4.214.0. Affected by this vulnerability is an unknown functionality in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223291. | Vulnerability Guideline | ||
|
2023-03-17 07:15:11 | CVE-2023-1444 (lien direct) | A vulnerability was found in Filseclab Twister Antivirus 8. It has been rated as critical. This issue affects some unknown processing in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223289 was assigned to this vulnerability. | Vulnerability Guideline | ||
|
2023-03-17 07:15:11 | CVE-2023-1447 (lien direct) | A vulnerability, which was classified as problematic, has been found in SourceCodester Medicine Tracker System 1.0. Affected by this issue is some unknown functionality of the file app/?page=medicines/manage_medicine.They. The manipulation of the argument name/description with the input alert('2') leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-223292. | Vulnerability Guideline | ||
|
2023-03-17 07:15:11 | CVE-2023-1445 (lien direct) | A vulnerability classified as problematic has been found in Filseclab Twister Antivirus 8. Affected is an unknown function in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. VDB-223290 is the identifier assigned to this vulnerability. | Vulnerability Guideline | ||
|
2023-03-17 07:15:10 | CVE-2023-1443 (lien direct) | A vulnerability was found in Filseclab Twister Antivirus 8. It has been declared as problematic. This vulnerability affects unknown code in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223288. | Vulnerability Guideline | ||
|
2023-03-17 07:15:10 | CVE-2023-1441 (lien direct) | A vulnerability has been found in SourceCodester Automatic Question Paper Generator System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin/courses/view_course.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223285 was assigned to this vulnerability. | Vulnerability Guideline | ||
|
2023-03-17 07:15:10 | CVE-2023-1440 (lien direct) | A vulnerability, which was classified as critical, was found in SourceCodester Automatic Question Paper Generator System 1.0. Affected is an unknown function of the file users/user/manage_user.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223284. | Vulnerability Guideline | ||
|
2023-03-17 07:15:10 | CVE-2023-1442 (lien direct) | A vulnerability was found in Meizhou Qingyunke QYKCMS 4.3.0. It has been classified as problematic. This affects an unknown part of the file /admin_system/api.php of the component Update Handler. The manipulation of the argument downurl leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223287. | Vulnerability Guideline | ||
|
2023-03-17 07:15:09 | CVE-2023-1439 (lien direct) | A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracker System 1.0. This issue affects some unknown processing of the file medicines/view_details.php of the component GET Parameter Handler. The manipulation of the argument GET leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223283. | Vulnerability Guideline | ||
|
2023-03-16 21:15:13 | CVE-2023-28113 (lien direct) | russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping. Most other implementations reject such keys, so this is mainly an interoperability issue in such a case. This issue is fixed in versions 0.36.2 and 0.37.1 | Guideline | ||
|
2023-03-16 21:15:13 | CVE-2023-27494 (lien direct) | Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit app(s) were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to a Streamlit app. The attacker could then trick the user into visiting the malicious URL and, if successful, the server would render the malicious javascript payload as-is, leading to XSS. Version 0.81.0 contains a patch for this vulnerability. | Vulnerability Guideline | ||
|
2023-03-16 21:15:11 | CVE-2022-43606 (lien direct) | A use-of-uninitialized-pointer vulnerability exists in the Forward Open connection_management_entry functionality of EIP Stack Group OpENer development commit 58ee13c. A specially-crafted EtherNet/IP request can lead to use of a null pointer, causing the server to crash. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability. | Vulnerability Guideline | ||
|
2023-03-16 21:15:11 | CVE-2022-43441 (lien direct) | A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability. | Vulnerability Guideline | ||
|
2023-03-16 21:15:11 | CVE-2022-43604 (lien direct) | An out-of-bounds write vulnerability exists in the GetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out-of-bounds write, potentially causing the server to crash or allow for remote code execution. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability. | Vulnerability Guideline | ||
|
2023-03-16 21:15:11 | CVE-2022-43605 (lien direct) | An out-of-bounds write vulnerability exists in the SetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out of bounds write, potentially causing the server to crash or allow for remote code execution. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability. | Vulnerability Guideline | ||
|
2023-03-16 18:15:11 | CVE-2023-0811 (lien direct) | Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program. | Guideline | ||
|
2023-03-16 13:15:10 | CVE-2023-1433 (lien direct) | A vulnerability was found in SourceCodester Gadget Works Online Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file admin/products/controller.php?action=add of the component Products Handler. The manipulation of the argument filename leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223215. | Vulnerability Guideline | ||
|
2023-03-16 13:15:10 | CVE-2023-1432 (lien direct) | A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /fos/admin/ajax.php?action=save_settings of the component POST Request Handler. The manipulation leads to improper access controls. The attack may be launched remotely. VDB-223214 is the identifier assigned to this vulnerability. | Vulnerability Guideline | ||
 |
2023-03-16 13:00:47 | Leçons sur la croissance de la carrière avec AT&T Cybersecurity CMO, Jill Sanders [Lessons on Career Growth with AT&T Cybersecurity CMO, Jill Sanders] (lien direct) | Jill Sanders, CMO à AT & # 038; T Cybersecurity, parle de son chemin vers la C-Suite, de la représentation féminine en leadership et d'AT & # 038; T \'s Partnership avec Palo Alto Networks.
Jill Sanders, CMO at AT&T Cybersecurity, talks about her path to the C-Suite, female representation in leadership, and AT&T\'s partnership with Palo Alto Networks. |
Guideline | ★★★ | |
 |
2023-03-16 09:58:00 | CheckMate (lien direct) | >Research by :Oded Vaanunu / Roman Zaikin / Dan Lasker Chess.com is the world leading platform for online chess games. It is an internet chess server, news website, and social networking website. Chess.com has a strong focus on community-based forums and blogs. These social features allow players to connect with each other, become friends, share […] | Guideline | ★★ | |
|
2023-03-16 00:15:11 | CVE-2023-28466 (lien direct) | do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). | Guideline | ||
|
2023-03-15 23:15:09 | CVE-2023-28099 (lien direct) | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if `ds_is_in_list()` is used with an invalid IP address string (`NULL` is illegal input), OpenSIPS will attempt to print a string from a random address (stack garbage), which could lead to a crash. All users of `ds_is_in_list()` without the `$si` variable as 1st parameter could be affected by this vulnerability to a larger, lesser or no extent at all, depending if the data passed to the function is a valid IPv4 or IPv6 address string or not. Fixes will are available starting with the 3.1.9 and 3.2.6 minor releases. There are no known workarounds. | Vulnerability Guideline | ||
|
2023-03-15 22:15:10 | CVE-2023-28096 (lien direct) | OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function `parse_mi_request` while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form `{"jsonrpc": "2.0","method": "log_le`. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time. To abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted interfaces. In cases where the MI is exposed to the internet without authentication, abuse of this issue will lead to memory exhaustion which may affect the underlying system’s availability. No authentication is typically required to reproduce this issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing JSON objects. The issue has been fixed in versions 3.1.8 and 3.2.5. | Guideline | ||
|
2023-03-15 22:15:10 | CVE-2023-28095 (lien direct) | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` which might lead to a server crash. This issue was found while fuzzing the function `build_res_buf_from_sip_req` but could not be reproduced against a running instance of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was found to make use of this vulnerable code. Even in the case of exploitation through unknown vectors, it is highly unlikely that this issue would lead to anything other than Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4. | Guideline | ||
|
2023-03-15 21:15:09 | CVE-2023-27599 (lien direct) | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, when the function `append_hf` handles a SIP message with a malformed To header, a call to the function `abort()` is performed, resulting in a crash. This is due to the following check in `data_lump.c:399` in the function `anchor_lump`. An attacker abusing this vulnerability will crash OpenSIPS leading to Denial of Service. It affects configurations containing functions that make use of the affected code, such as the function `append_hf`. This issue has been fixed in versions 3.1.7 and 3.2.4. | Vulnerability Guideline | ||
|
2023-03-15 21:15:09 | CVE-2023-27598 (lien direct) | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, sending a malformed `Via` header to OpenSIPS triggers a segmentation fault when the function `calc_tag_suffix` is called. A specially crafted `Via` header, which is deemed correct by the parser, will pass uninitialized strings to the function `MD5StringArray` which leads to the crash. Abuse of this vulnerability leads to Denial of Service due to a crash. Since the uninitialized string points to memory location `0x0`, no further exploitation appears to be possible. No special network privileges are required to perform this attack, as long as the OpenSIPS configuration makes use of functions such as `sl_send_reply` or `sl_gen_totag` that trigger the vulnerable code. This issue has been fixed in versions 3.1.7 and 3.2.4. | Vulnerability Guideline | ||
 |
2023-03-15 20:19:00 | SecurityScorecard Appoints Former US Congressman John Katko As Senior Advisor (lien direct) | Capitol Hill cybersecurity leader joins the company's Cybersecurity Advisory Board to drive further adoption of security ratings in the public and private sectors. | Guideline | ★ | |
|
2023-03-15 20:15:10 | CVE-2020-27507 (lien direct) | The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact. | Guideline | ||
|
2023-03-15 18:15:10 | CVE-2022-43874 (lien direct) | IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, 6.2, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 239963. | Vulnerability Guideline | ||
 |
2023-03-15 17:14:27 | Semperis Joins Microsoft Intelligent Security Association, Expanding Collaboration to Combat Identity-Related Cyber Threats (lien direct) | Semperis Joins Microsoft Intelligent Security Association, Expanding Collaboration to Combat Identity-Related Cyber Threats. Identity-first cybersecurity leader's Directory Services Protector solution for Microsoft Sentinel, available in the Microsoft Azure Marketplace, provides seamless integration to bring critical cyber threats to the forefront in Sentinel views - Business News | Guideline | ★★ | |
|
2023-03-15 16:15:11 | CVE-2023-1418 (lien direct) | A vulnerability classified as problematic was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file cashconfirm.php of the component POST Parameter Handler. The manipulation of the argument transactioncode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223129 was assigned to this vulnerability. | Vulnerability Guideline | ||
|
2023-03-15 16:15:11 | CVE-2023-1416 (lien direct) | A vulnerability classified as critical has been found in Simple Art Gallery 1.0. Affected is an unknown function of the file adminHome.php. The manipulation of the argument social_facebook leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223128. | Vulnerability Guideline |
To see everything:
Our RSS (filtrered)
