NFL has nothing better to do than mistake an iPad Glove for an injury
While carrying an iPad, Cincinnati Bengals' player Joe Burrow wore a tablet glove before a game, then injured his wrist during it — and now crack NFL investigators are looking for a molehill.Joe Burrow and (inset) the video showing a mysterious device aka an iPad gloveIt's "CSI: NFL" as social media footage of Burrow wearing something on his wrist has been slowed down, highlighted, possibly deleted, and maybe then recovered. It's all very suspicious, until you see the footage and without ever having heard of tablet gloves, immediately know that he's wearing an tablet glove. Read more...

Read more »

OLED iPad mini with larger screen, new iPad Air, and more in development
Apple’s plans to transition the iPad to OLED displays have been well-documented. The iPad Pro will kick-start the transition in 2024, with the rest of the iPad lineup to follow. A new report from ET News today offers more details on the future of the iPad. One of the most notable tidbits to me: an iPad mini with a larger 8.7-inch OLED display is in the works. more…

Read more »

Apple will support RCS, but keeps green bubbles for Android messages
Apple says it will support the RCS messaging standard that will make it easier to send texts between real and pretend iPhones, but messages… The post appeared first on MacDailyNews.

Read more »

Best MacBook 2023-2024: Which MacBook should I buy?
Macworld Wondering which type of MacBook to buy? This buying guide will help you decide which Apple laptop is best for you. Apple makes two types of laptops, the MacBook Air and the MacBook Pro. Within those two categories of Mac is a wide range of capabilities, the gap between the entry-level MacBook Air and the high-end 16in MacBook Pro is vast, but even within the MacBook Pro category you will find huge differences. We have more information on the differences between the MacBook Air and Pro in another article. While there are five MacBook Air models and nine MacBook Pro models sold as standard, in reality, there are multiple combinations if you factor in all the build-to-order options that you can add such as extra RAM, more storage, or a faster processor, with which you can build an even more powerful Mac, should you need to. Choosing which of the 14 MacBooks to buy can be a tough decision, fortunately, we are here to help. If you’re not sure yet if you want a laptop or desktop Mac, you should also read our Mac buying guide, which covers both MacBooks and Apple’s desktop Macs. We also compare all the MacBook Pro models here: Which MacBook Pro. There are various sections in this article. If you aren’t sure which Mac laptop you want then read on, if you have a vague idea but are choosing between two similar models, or if your needs are more professional than personal, then you might find the models further down this article more relevant. In that case, we suggest that you jump to the section that is most relevant to your needs. See the Table of Contents above. MacBook release dates One consideration to make when shopping for a MacBook is how recently Apple updated the laptop and whether it is likely to be updating it again soon. Here is a quick look at when the laptops Apple is selling were released. 13-inch MacBook Air (M1): November 2020 13-inch MacBook Air (M2): July 2022 15-inch MacBook Air (M2): June 2023 13-inch MacBook Pro (M2): June 2022 DISCONTINUED in October 2023 14-inch MacBook Pro (M3, M3 Pro & M3 Max): October 2023 16-inch MacBook Pro (M3 Pro & M3 Max): October 2023 We expect that the MacBook Air will be updated to the M3 chip in the spring of 2023. What happened to the 13-inch MacBook Pro? Before we begin, there’s a MacBook missing from the lineup that we should mention briefly. The 13-inch MacBook Pro is no longer sold by Apple, but it will no doubt be available from resellers and Apple’s refurbished store for a while yet. There were two standard 13-inch MacBook Pro to consider. The only real difference is storage here though: M2, 8-Core CPU, 10-Core GPU, 8GB Unified Memory, 256GB SSD Storage: Was $1,299 / £1,349 M2, 8-Core CPU, 10-Core GPU, 8GB Unified Memory, 512GB SSD Storage: Was $1,499 / £1,549 Apple 13-inch MacBook Pro (M2, 2022) Read our review Price When Reviewed: $1,299 Best Prices Today: $1099 at Best Buy | $1239 at Walmart | $1,259.99 at Amazon The 13-inch MacBook Pro has been replaced by the M3 version of the 14-inch MacBook Pro, which costs more, but has a far superior screen, better battery life and many other benefits that we will discuss below. The 13-inch MacBook Pro had a few advantages over the MacBook Air, better cooling being of importance to anyone who would be pushing the machine to any extent. The other advantage of the 13-inch MacBook Pro is the Touch Bar, which is something that some people enjoyed, while others weren’t convinced by. If you want a Touch Bar you’ll want to snap up one of the last 13-inch MacBook Pro before they run out. MacBook buyers guide We’ll start by running through the different MacBooks Apple sells, giving an overview of the pros and cons of each model, and reasons why each might be ideally suited to your needs. You’ll also be able to see the best prices right now, so that you don’t spend more than you need to. We will also look at different components and features for each model, so you can make an informed decision about how much RAM, which chip, how big the SSD should be and the best price, so you don’t spend more than necessary. 1. Apple 13-inch MacBook Air (M2, 2022) Price When Reviewed: $1,099 (WAS $1,199) Best Prices Today: $949 at Best Buy$1049 at Adorama$1049 at Walmart The MacBook Air is the cheapest way to get a Mac laptop. Starting at $999/£999 for the older M1 model, or $1,099/£1,149 for the M2 model (reduced in July 2023 from it’s original $1,199/£1,249). There are five standard MacBook Air to consider: one 13-inch model with an M1 chip, two 13-inch models with M2 chip, and two 15-inch MacBook Air with M2 chip. We’ll be discussing the 15-inch models next, first we will focus on the 13-inch models. It’s easy to think that the cheapest Mac laptop will be the one that is the best value, but that’s not necessarily the case. The M1 MacBook Air (see our M1 MacBook Air review) is the cheapest Mac laptop you can buy right now, but you only have to spend another $100/£100 to get a far superior machine with M2 chip with an 8‑Core GPU rather than M1 chip with a 7-core GPU. Both models offer the same amount of storage 256GB and the same 8GB RAM as standard. With the M2 13-inch MacBook Air you also get a brand new design with an even bigger (13.6-inch vs 13.3-inch) and brighter screen (500 vs 400 nits) and more color choices (Midnight, Starlight, Space Gray and Silver, rather than Space Grey, Silver and Gold). The design of the new model may be reason enough for you to pay the extra money. Read: M1 MacBook Air vs M2 MacBook Air for more information about the differences. Back when Apple still sold the 13-inch MacBook Pro there was a question of whether the MacBook Pro would be a better option than the MacBook Air. The price difference wasn’t that great and the size and weight difference probably wasn’t as much as you would expect. The Air had a lot going for it, the lighter, slimmer case, a bigger screen (13.6-inch vs. 13.3-inch), and a much better FaceTime camera being a few points in its favor. But the 13-inch MacBook Pro had a big benefit compared to the Air: the inclusion of a fan instead of relying on an aluminum heat spreader to draw heat away. Although Apple no longer sells the 13-inch MacBook Pro, this is still relevant because the lack of a fan may well mean that the MacBook Air struggles when performing more strenuous tasks and the 14-inch MacBook Pro might be a better option. Because the MacBook Pro has a fan it is able to keep cool it isn’t necessary for the Mac to slow down to stop overheating in processor-intensive applications. It’s probably the key difference between these Mac laptops and the reason why the Pro is better suited to more demanding applications. This kind of thing could make a big difference to you if you do that sort of work. Unfortunately, the price difference between a MacBook Air and MacBook Pro is a lot bigger than it was before Apple discontinued the 13-inch model. Another benefit of the MacBook Pro over the Air is longer battery life. The 14-inch MacBook Pro with M3 offers up to 22 hours compared to 18 hours for the 13-inch MacBook Air. We’ll discuss the 14-inch MacBook Pro in more detail below. The MacBook Air is a good choice, especially now that the entry-level of the MacBook Pro range is much higher than it was. The main disadvantage right now is that Apple hasn’t yet updated the MacBook Air to the M3 chip, while the 14-inch MacBook Pro is already furnished with one. We expect that Apple will soon update the MacBook Air with the M3, so if you can wait until the spring or 2024 we recommend you do. If you need more power we recommend the MacBook Pro due to the lack of fan in the Air. Read our full Apple 13-inch MacBook Air (M2, 2022) review 2. Apple 15-inch MacBook Air (M2, 2023) Price When Reviewed: From $1,299 Best Prices Today: $1,049.00 at Amazon$1099 at Best Buy$1244 at Adorama When Apple introduced the 15-inch MacBook Air in July 2023 it answered a need for anyone who wanted a larger screen without having to fork out $2,000 (at the time) for a 14-inch MacBook Pro. The 15-inch MacBook Air starts at $1,299/£1,399. The 14-inch MacBook Pro now starts at $1,599/£1,699 for the M3 version, which is significantly less than the $1,999/£2,149 the M2 Pro model sold for. But the 15-inch Air will still cost you $300/£300 less, so if the only thing that matters is getting a big screen then it’s a great option. If the choice is between the 13-inch and 15-inch MacBook Air, other than the bigger screen there are a few other differences to consider, including better audio capabilities on the larger model (six speakers, rather than four). The entry-level 13-inch MacBook Air starts at $1,099/£1,149, but that model offers only an eight-core GPU, while the entry-level 15-inch Air, which is $200/£250 more at $1,299/£1,399, offers a 10-core GPU. To add that GPU option to the 13-inch Air could cost an additional $100/£100. The price gap is so small that it’s definitely worth getting the larger model if you want a larger screen. Read our full Apple 15-inch MacBook Air (M2, 2023) review 3. Apple 14-inch MacBook Pro (M3, 2023) Price When Reviewed: $1,599 Best Prices Today: $1,449.00 at Amazon$1509 at Walmart$1599 at Adorama Apple has discontinued the 13-inch MacBook Pro and replaced it in the lineup with an M3 version of the 14-inch MacBook Pro (you can’t get the M3 in the 16-inch MacBook Pro). This move brings many benefits: it’s not just bigger, the 14-inch MacBook’s HDR ProMotion display is significantly better than the 13-inch model’s, it also offers twice the storage, HDMI, SDXC slot, better battery life, and a newer design. Mind you, the 14-inch model, while starting at the lower price of $1,599/£1,699 (versus $1,999/£2,149 for the M2 Pro model), is quite a bit higher than the $1,299/£1,349 price that the 13-inch model sold for.  The higher starting price for the M3 MacBook Pro also means the difference between the MacBook Air and MacBook Pro is wider than it was. Apple did sell two almost identically specced machines for a very similar price. But now the 14-inch MacBook Pro costs an astonishing $500/£550 more than the entry-level 13-inch MacBook Air. The MacBook Pro now has a better screen, better battery life, and other benefits. It is also a chip generation ahead, but that is unlikely to be the case for long and when Apple updates the MacBook Air it will make the choice even simpler. Save your money and buy a MacBook Air, but wait until the M3 model arrives since it will support up to 24GB RAM-speaking of RAM, we don’t think the standard 8GB RAM is enough! 4. Apple 14-inch MacBook Pro (M3 Pro, 2023) Price When Reviewed: $1,999 Best Prices Today: $1,849.00 at Amazon$1999 at Adorama$1999 at Apple At the same time that it introduced the M3 14-inch MacBook Pro, Apple also introduced the M3 Pro and M3 Max. Both the 14-inch and 16-inch MacBook Pro can be bought with various configurations of those two chips. You don’t need to buy a 16-inch MacBook Pro to get the best specs.  For those deciding between the 14-inch MacBook Pro and 16-inch model the best place to start is to compare like-for-like. The 12-core CPU, 18-core GPU M3 Pro with 18GB unified memory and 1TB SSD 14-inch MacBook Pro costs $2,399/£2,499 compared to the almost identically specced 16-inch model with 12-core CPU, 18-core GPU M3 Pro with 18GB unified memory and 512GB SSD for $2,499/£2,599. So you are paying $100/£100 more to get a larger screen, but also forfeiting half the SSD. If you want an equivalent 1TB SSD in the 16-inch that’s an extra $200/£200..  On the other hand, if you are considering spending more to get the M3 Pro rather than the M3 in an MacBook Pro, the price difference is much greater. The 14-inch MacBook Pro with 8-core CPU and 10-core GPU M3, with 8GB Unified Memory and 512GB SSD costs $1,599/£1,699, while the 14-inch MacBook Pro with 11-core CPU and 14-core GPU M3 Pro, 18GB Unified Memory and 512GB SSD costs $400/£400 more at $1,999/£2,099. The jump from M3 to M3 Pro is an expensive one, but you are getting a lot for your money: more memory, more cores, essentially a more powerful machine in every way.   But if you don’t have that kind of budget then the M3 MacBook Pro has proven to be equal to the M2 Pro in terms of performance when measured by Geekbench 6. 5. Apple 16-inch MacBook Pro (M3 Pro, 2023) Price When Reviewed: $2,499 Best Prices Today: $2,299.00 at Amazon$2344 at Walmart$2499 at Adorama If you really want that 1TB SSD in the 16-inch MacBook Pro it will cost you an extra £200/$200. The 1TB version costs £2,599/$2,699. This model essentially offers the same specs as the top-of-the-range 14-inch MacBook Pro for just £200/$200 more, which to be fair doesn’t seem like a bad deal given the larger screen and increased battery life. 6. Apple 14-inch MacBook Pro (M3 Max, 2023) Price When Reviewed: $3,199 Best Prices Today: $2,994.00 at Amazon$3199 at Adorama$3199 at Apple Sticking with the 14-inch model for now, what if you want an even more powerful machine. The M3 Max chip will offer that and more to you, but there is a high price to pay with the difference between the standard M3 Pro and M3 Max models being $800/£800. If you want more memory then the M3 Max is the way to go though. This is not just because the M3 Max can support 48GB, 64GB, 96GB and 128GB Unified Memory, while the M3 Pro only offers 18GB or 36GB Unified Memory. The M3 Pro MacBook Pro ships with 18GB memory as standard while the M3 Max model ships with 36GB memory as standard. That 36GB memory, if you added it to the M3 Pro model as a build-to-order option would cost you an extra $400/£400, bringing the price to $2,799/£2,899, which is still $400/£400 less than the entry-level M3 Max at $3,199/£3,299, but you do get more 14-core CPU, 30-core GPU rather than a 12-core CPU, 18-core GPU. So you are getting a lot for your money if you choose the M3 Max.  Read about why one of our editors sent their M3 Pro back and switched to an M3 Max. Read our full Apple 14-inch MacBook Pro (M3 Max, 2023) review 7. Apple 16-inch MacBook Pro (M3 Max, 2023) Price When Reviewed: $3,499 Best Prices Today: $3499 at Apple$3,999.00 at Amazon The story is much the same if you are considering the 16-inch MacBook Pro. The leap from M3 Pro to M3 Max if you look at the standard options is $600/£600, but if you were to up the RAM in the M3 Pro model to 36GB then that would be $400/£400, leaving a difference of $200/£200 for the 14-core CPU, 30-core GPU (compared to the 12-core CPU/18-core GPU of the M3 Pro). If you need the M3 Max Apple is making the upgrade worthwhile, but it’s still a high price to pay. Read our full Apple 16-inch MacBook Pro (M3 Max, 2023) review Which Apple MacBook: Verdict So, the choice is pretty clear in terms of what you get for your money: Buying an entry-level M1 MacBook Air for £999/$999 will get you a decent Mac laptop for less than a grand, but it only costs $100/£150 more to get an M2 MacBook Air with a brand new design, a bigger screen, and a newer chip. The only reason not to buy the M2 MacBook Pro right now is that Apple is likely to upgrade it to the M3 soon–but when it does so expect the M1 model to disappear from the lineup. The 15-inch MacBook Air shook up the range when it arrived in July 2023, also featuring an M2 chip. It lowered the price of getting a larger screen on a Mac laptop. Even now that price of entry for the 14-inch MacBook Pro has been lowered the 15-inch MacBook Air is still an attractive proposition, but again, we’d wait for the M3 model to arrive. Now that the 13-inch MacBook Pro has been retired the price of entry for a MacBook Pro has risen, which is another point in favour of the MacBook Air. But the 14-inch MacBook Pro is a far superior machine to the old 13-inch model thanks to a much better screen. The M3 chip supports more memory – and we recommend you get as much Unified Memory as you can afford because the standard 8GB is not nearly enough these days. The price of the M3 Pro models is high, but these MacBook Pro models offer the kind of specs professional users, especially creatives, need, including support for up to 36GB Unified Memory, and more CPU and GPU cores. If you can afford to stretch to the M3 Max then you will get the ultimate Mac without a doubt, but you may need to remortgage to afford to. When it comes to the choice between the 14-inch and 16-inch MacBook Pro it really is all down to the screen size. The 16-inch models are more expensive, but once you spec them out in such a way to be comparable the price difference is really minor. So if you want 16-inch screen then go for it. Alternatively plug your MacBook into an external display when you are at your desk. This being the other major benefit of the M3 Pro and M3 Max chips compared to the M3–the M3 will only support one external screen while you can plug in multiple displays and use them with an M3 Pro or M3 Max MacBook Pro. For the latest MacBook Pro discounts, including discontinued models, check out our round-up of the Best MacBook Pro deals. Mac, MacBook

Read more »

Apple fights EU law that forces sideloading apps onto iPhone
Apple filed a challenge to an European Union law that requires iPhones to allow sideloading applications. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Amazon is slashing $150 off all M3 MacBook Pro models ahead of Black Friday
Macworld It hasn’t even been a month since the M3 MacBook Pros have been on shelves and we’re already seeing the first significant discounts: Amazon is selling the 14-inch M3 MacBook Pro for $1,449, the 14-inch M3 Pro MacBook Pro for $1,849, and the 16-inch M3 Pro MacBook Pro for $2,249, a savings of $150 on each and the best price we’ve seen so far. The main reason to buy one of these machines is the new M3 chip, which brings a nice speed boost over the prior generation. The entry-level M3 model replaces the aging 13-inch MacBook Pro with a new design and upgraded display. It also gets HDMI and an SD card reader like the higher-end Pro models. And the M3 Pro models now come in Space Black, the first new Pro color in more than a decade. In our 4.5-star review of the 16-inch MacBook Pro, we praised the new color and chip and concluded that anyone still using an older MacBook Pro “really missing out if you stick with Intel.” So go grab one while the price is better than ever. MacBook

Read more »

Google Maps widely rolling out new color palette
Google has announced a slew of new features for Maps in recent weeks, including Immersive View for routes, more detailed navigation, and transit filters. Google Maps is now rolling out a new color palette.  more…

Read more »

This 4K portable monitor is beautiful and surprisingly affordable [Review] ★★★★☆
The KYY K3-3 Portable Monitor adds a high-quality 4K second screen to your Mac or iPad. Even iPhone. We went hands on to test it. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

macOS Sonoma: How to use ‘Add to Dock’ in Safari to turn websites into Mac apps
New in macOS Sonoma, Apple gives everyone new reasons to never need to open Chrome again. One of those is a new feature for turning any website into an app on your Mac’s Dock.  more…

Read more »

Early Black Friday M3 MacBook Pro deals from $1,449, official MagSafe charger $29, more
Black Friday is just a week away, and the early discounts are here on Apple’s new M3 MacBook Pro. Pricing now starts at $1,449 to go alongside the same holiday offer on the official Apple MagSafe Charger at $29. And since we’re already talking about the holidays, you might as well deck the halls with the Nanoleaf Matter Smart Christmas Lights at $90. Hit the jump for all that and more in the latest 9to5Toys Lunch Break. more…

Read more »

Amazon issues price cut on Apple's iPad 10th Generation, now $349
The latest Apple iPad (10th Generation) is currently on sale for $349, a remarkable deal for tech enthusiasts and holiday shoppers.Apple's 10th Generation iPadAt the heart of the iPad (10th Generation) is the powerful A14 Bionic chip, which promises lightning-fast performance whether you're multitasking, streaming, or gaming. This chip ensures a smooth user experience and guarantees efficiency, contributing to the device's all-day battery life. At $100 off at Amazon, these are the best prices we've seen on the 10th Gen line. Read more...

Read more »

∞ The Dalrymple Report: MacBook Pro, Apple services, and health care
Dave and I talk about Apple's recently released MacBook Pro and iMac computers, and what we liked about them. We also talk about Apple's recent hike in pricing for its media services and a general discussion on how streaming prices are going up across the board. When does pricing fatigue settle in for consumers? Apple may have some new health sensors coing out in the Apple Watch in the next year. We talk about how significant those are for the general public. Follow this podcast Brought to you by: Factor: Factor now offers 34 meals per week and 45+ add-on options including Protein Plus, Keto, Calorie Smart, Vegan + Veggie. Get 50% off using code dalrymple50 when you visit Factor today! MasterClass: This holiday season, give One Annual Membership and Get One Free at MASTERCLASS.com/dalrymple. Right now you can get Two Memberships for the Price of One at MASTERCLASS.com/dalrymple. Offer terms apply. Show Notes: MacBook Pro iMac How Apple Made the Space Black MacBook Pro Darker Than Ever Apple Again Hikes Prices for Its Media Services Manslaughter arrest over ice hockey player's death Another fire breaks out underneath L.A. freeway The Beatles Chart Their Biggest Hits Ever On A Billboard Chart 60 Years Into Their Career 3D movies showing up in Apple TV app ahead of Apple Vision Pro launch First Impressions: iPhone 15 Pro Spatial Videos on Vision Pro Apple Has Plans to Eventually, Maybe Revolutionize Health Care Shows and movies we're watching Blood, Acorn Baptiste, PBS The Killer, Netflix

Read more »

Dock connects lean new MacBook Pro to lovely old Cinema Display [Setups]
They may cost a pretty penny, but Apple displays are loved for good reason -- including the oldies that keep popping up in modern setups. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Buy 2, get a third one free: SwitchEasy magnetic wall mounts for iPhone
Though December 1, when you buy two MagEasy or MagPoka magnetic wall mounts for iPhone in our store, you can get another one free. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple TV+ Godzilla series ‘Monarch: Legacy of Monsters’ now streaming
Apple TV+'s new Godzilla series, “Monarch: Legacy of Monsters,” arrived globally on Friday, November 17th and is now available for streaming… The post appeared first on MacDailyNews.

Read more »

Apple files legal case contesting EU’s Digital Markets Act
Apple has filed a legal case contesting decisions taken by the European Commission under its recently-introduced Digital Markets Act … The post appeared first on MacDailyNews.

Read more »

Enjoy tons of Legos without the clutter in Bricktales [Awesome Apps]
Lego Bricktales is a fun way to play with these bricks wherever you go. The game challenges players to build their way through puzzles in a variety of colorful environments. It’s available for iPad and iPhone. Lego Bricktales takes a classic toy digital So many of my childhood memories revolve around Legos. It was absolutely […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple TV+ shows and movies: Everything to watch on Apple TV Plus
Apple TV+ offers exclusive Apple original TV shows and movies in 4K HDR quality. You can watch across all of your screens and pick up where you left off on any device. Apple TV+ costs $9.99 per month. Here’s every Apple original television show and movie available now on Apple TV+, as well as the latest trailers … more…

Read more »

Score $200 off M3 Pro MacBook Pro in this Black Friday deal
Apple's late-2023 M3 Pro-powered MacBook Pros are available with up to $200 in this amazing pre-Black Friday deal. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple files legal challenge over Europe's demand for third-party app stores
Apple has filed its anticipated legal case against the European Commission's Digital Markets Act, and is believed to specifically protest being forced into supporting rivals to its App Store.The Digital Markets Act was created specifically to target Big Tech firms including Apple, and while certain implementation details are still being worked on, it became applicable from May 2023. It says that companies it defines as "gatekeepers" are now required to make their services interoperable with those of rivals.Apple has recently been reported to be preparing an appeal specifically against the ruling that it be required to allow rival app stores on its iPhone and other devices. Read more...

Read more »

Apple TV+ unveils new teaser trailer for ‘The Dynasty: New England Patriots’ documentary; premieres February 16th
Apple TV+ today released the teaser trailer for “The Dynasty: New England Patriots,” the highly anticipated 10-part documentary event from… The post appeared first on MacDailyNews.

Read more »

Get up to $250 off Bose headphones and soundbars in new Black Friday sales
Bose QuietComfort 45 and QuietComfort Ultra headphones are among the firm's deals across many stores; here's where to get the best prices for these top-rated devices.There are savings across the board on Bose headphones, earbuds, soundbars and speakers, ranging from $30 to $250 at retailer Adorama.The highlights of the sale include the Bose QuietComfort Ultra noise cancelling headphones that are usually sold for $429, but for a limited time Adorama has them for $379. There's also a $50 saving at Adorama on the QuietComfort Ultra headphones plus a 10,000mAh wireless powerbank, for $402.99. Read more...

Read more »

Apple Arcade Guide: This week’s release plus everything that’s available
Apple Arcade launched with close to 100 titles and the service is seeing new games added regularly with over 200 games now in the library. Follow along with our guide on all the available Apple Arcade games plus the latest releases. more…

Read more »

Apple Says RCS Messages Will Have Green Bubbles
Apple announced on Thursday its plans to bring RCS support to the iPhone in 2024. But some things are not going to change, sadly. 9to5Mac reports: Since I published my story on the news this morning, there's one thing everyone wants to know: is the blue bubbles vs green bubbles debate coming to an end? I'm happy to say I now have an official answer: nope. RCS will use green bubbles just like SMS. [...] Apple has confirmed to me that blue bubbles will still be used to represent iMessages, while green bubbles will represent RCS messages. The company uses blue bubbles to denote what it believes is the best and most secure way for iPhone users to communicate, which is iMessage. Read more of this story at Slashdot.

Read more »

Apple Says RCS Messages Will Have Green Bubbles
Apple announced on Thursday its plans to bring RCS support to the iPhone in 2024. But some things are not going to change, sadly. 9to5Mac reports: Since I published my story on the news this morning, there's one thing everyone wants to know: is the blue bubbles vs green bubbles debate coming to an end? I'm happy to say I now have an official answer: nope. RCS will use green bubbles just like SMS. [...] Apple has confirmed to me that blue bubbles will still be used to represent iMessages, while green bubbles will represent RCS messages. The company uses blue bubbles to denote what it believes is the best and most secure way for iPhone users to communicate, which is iMessage. Read more of this story at Slashdot.

Read more »

Apple Says RCS Messages Will Have Green Bubbles
Apple announced on Thursday its plans to bring RCS support to the iPhone in 2024. But some things are not going to change, sadly. 9to5Mac reports: Since I published my story on the news this morning, there's one thing everyone wants to know: is the blue bubbles vs green bubbles debate coming to an end? I'm happy to say I now have an official answer: nope. RCS will use green bubbles just like SMS. [...] Apple has confirmed to me that blue bubbles will still be used to represent iMessages, while green bubbles will represent RCS messages. The company uses blue bubbles to denote what it believes is the best and most secure way for iPhone users to communicate, which is iMessage. Read more of this story at Slashdot.

Read more »

Today in Apple history: Copland, Apple’s ‘unreleased’ Mac OS, ships to devs
On November 17, 1995, Apple seeded a beta of its Mac OS Copland operating system to about 50 developers. The full version was never released. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple's entire OLED iPad plan may have just been leaked
A new report says that single-stack OLED screens will come to the iPad Air, an 8.7-inch and iPad mini in 2026, plus a new 12.9-inch iPad Air in 2027.The current iPad AirApple has been reportedly working on moving to an OLED screen for the iPad Pro for some time. The latest rumor is that the display technology will be used in the 2024 iPad Pro and 2026 MacBook Pro. Read more...

Read more »

How to figure out what iPhone model you have
Macworld Whether you’re an experienced iPhone user or just got your first iPhone, it can be hard to know which model you have. Apple updates the iPhone every year, but it doesn’t always change the design—sometimes the significant changes are on the inside, such as faster new components. There are various reasons why you might be wondering what iPhone I have. Not everyone walks into an Apple shop to buy the latest model. You might have been handed down an iPhone by a family member who was unclear about which model it is, in which case you might be wondering if it would be a good idea to update the iOS on it. This can be an issue because only certain models can run the latest version of iOS. If you’re struggling to identify one of your other Apple devices, we also have guides to finding which iPad you have and which Mac you have. Read on to find out how to tell which iPhone you have. Check your iPhone Name in Settings The simplest way to tell which iPhone you have is to open up the Settings app. Open the Settings app. Go to General > About. At the top of the list, you’ll see Model Name, which tells you exactly which iPhone model you have. Tip: You can also scroll down to check the capacity of your iPhone, which is something you will want to share if you are thinking of selling it. As long as you can get into Settings it’s easy to see what iPhone you have. Foundry Check the Model number Below Model Name, you will also see Model Number in Settings. This can tell you a little more than the name of the device. This is actually even more useful because the number that is displayed by default is actually the part number (it probably begins with an M, though if you have a replacement phone it may start with an N). If you pop that part number into a search engine it will tell you exactly which model you have including capacity and color. There’s a huge number of possible M numbers, far more than we can list here. Check the iPhone Wiki for a full list. Find the Part Number Here’s how to find that iPhone part number in Settings. Open the Settings app. Go to General > About Below Model Name you will see Model Number. Tap Model Number to see the Part Number (it will begin with an A). The A number is hidden – you have to tap on the Model Number section. Foundry The easiest way to identify an iPhone if you couldn’t turn it on used to be to check the part number that was etched onto the back. But Apple hasn’t printed part numbers on the back since the iPhone 7. If you have a recent model, or find the number too small to read, there are other ways to identify the iPhone A number, which we will discuss below. This model number can give you useful information like the country it was sold in, which may be important for warranty reasons. If you have an older iPhone If you have an older iPhone (iPhone 7 and earlier) you will see a small identification number printed on the back. When we say “small number,” we really do mean small, and you may find it hard to read the number with the naked eye. A magnifying glass will help if you’ve got one! Apple used to print the model number on the back of iPhones. IDG If you have a SIM tray There is another way to find the A number if you can’t turn your iPhone on and it’s not on the back, but you may need a magnifying glass! Assuming you have one of those tools for removing a SIM tray handy pop it out and look very carefully at the slot where the SIM card goes and you can see the A number. (Note, Apple stopped putting SIM trays in iPhones with the iPhone 14.) If you have a poky thing for opening the SIM card slot you can find the A number. Look for design differences If you simply can’t turn the iPhone on to check Settings for the information above, don’t worry. You can still tell which kind of iPhone you’ve got by checking its build, external features, and so on. Simply compare it against this guide, which includes all models of iPhone. If you’re trying to identify a bricked device or one you can’t unlock, this visual identification guide section is for you. iPhone 15 Pro/15 Pro Max: Apple’s newest iPhone has titanium sides instead of stainless steel and comes in four new colors: black titanium, white titanium, blue titanium, and natural titanium. It’s the first iPhone to have a USB-C port on the bottom instead of Lightning. iPhone 15/15 Plus: The iPhone 15 ditches the notch for the Dynamic Island and comes in several new shades, including pink, yellow, green, blue, and black. The iPhone 14 Pro/14 Pro Max: The iPhone 14 Pro has the Dynamic Island instead of a notch and comes in two unique colors, deep purple and space black, along with silver and gold. iPhone 14/14 Plus: The iPhone 14 line is the first with a 6.7-inch model in the Plus and comes in several new colors, midnight, starlight, red, blue, purple, and yellow. The iPhone 13 iPhone 13 Pro/13 Pro Max: The iPhone 13 Pro has a smaller notch than its predecessor and comes in the following colors: Graphite, Gold, Silver, Sierra Blue, and Alpine Green. iPhone 13/13 mini: Like the Pro, the iPhone 13 has a smaller notch than the 12 and has a diagonal camera layout for the first time. It comes in purple, blue, green, red, white and black. The iPhone SEDominik Tomaszewski iPhone SE (3rd Gen): Unless you have an iPhone that’s many years old, the SE is the only iPhone made since 2017 that has a home button. It’s trickier to tell the difference between the 2nd-gen and 3rd-ge models, as the colors are only slightly different (starlight and and midnight vs white and black). iPhone 12 Pro/12 Pro Max: The iPhone 12 Pro has a “flat” design with a relatively small camera array on the back. The Pro Max is Apple’s first 6.7-inch iPhone and comes in silver, graphite, gold, Pacific Blue. iPhone 12/12 mini: The iPhone 12 has a vertical camera arrangement and comes in black, white, red, light green, dark blue and purple. The 5.4-inch mini model is one of only two and the only with a vertical camera array. It’s also Apple’s first non-Pro phone with an OLED display. The iPhone 12 iPhone 11 Pro/11 Pro Max: The iPhone 11 Pro is Apple’s first triple-camera phone and its last with curved edges. It comes in gold, silver, space gray, and Midnight Green. iPhone 11: The iPhone 11 has curved edges and a dual camera with a vertical array. It has a plastic back and comes in white, black, green, yellow, purple and red. The iPhone 11 and 11 Pro iPhone XS/XS Max: The iPhone XS looks extremely similar to the iPhone X but the Max model is the first iPhone over six inches. It comes in a new color, gold, along with white and black. iPhone XR: The iPhone XR is Apple’s first 6.1-inch iPhone and has a single camera on the back. It comes in six colors: black, white, blue, yellow, coral and red. The iPhone XR iPhone X: The iPhone X is Apple’s first iPhone without a home button and is available in two colors, silver and space gray. It has a completely new design with stainless steel sides and a notch for the front camera. If you have one you should probably keep it. The iPhone X was the first iPhone to lose the Home button. iPhone 8/8 Plus: The iPhone 8 is Apple’s last design with a home button (until the SE revived it) and comes in silver, space gray, gold, and red. iPhone 7/7 Plus: The iPhone 7 is Apple’s last with an aluminum back and first with a dual camera. It also ditches the headphone jack. It was also the first iPhone to come in red and the only to come in Jet Black. iPhone 6/6S: Apple completely redesigned the iPhone 6 with a 4.7-inch screen and a curved design iPhone 6 Plus/6S Plus: The iPhone 6 Plus introduced a 5.5-inch display for the first time and come in black, silver, gold, and rose gold. iPhone SE (1st-gen): The original iPhone SE is a revamped iPhone 5s with a new rose gold color. iPhone 5/5S: The iPhone 5 has a larger 4-inch display while the 5S ditched the clicky Home button for a new Touch ID fingerprint scanner. iPhone 5c: This one’s easy to spot: The iPhone 5c came in a range of bright plastic colors and had a curved plastic back. No other iPhone looks like this. iPhone 4/4S: The Phone 4 has a completely new flat design with a glass back. iPhone 3G/3GS: the iPhone 3G has a similar design to the original but with a plastic back. The iPhone 3GS also came in white along with black. Original iPhone: The first iPhone has a silver back with a large black antenna band across the bottom. it has a 3.5-inch display. For more advice on the various handsets that Apple sells, take a look at our iPhone buying guide. And if you’re looking to pick up a bargain on your next handset, check our roundup of the best iPhone deals. iPhone

Read more »

Get a lifetime subscription to a speedy VPN for less than $40
Secure your online privacy and enhance your browsing experience with a lifetime subscription to Ivacy VPN. Works on iOS, macOS and more. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Alleged Extortioner of Psychotherapy Patients Faces Trial
Prosecutors in Finland this week commenced their criminal trial against Julius Kivimäki, a 26-year-old Finnish man charged with extorting a once popular and now-bankrupt online psychotherapy practice and thousands of its patients. In a 2,200-page report, Finnish authorities laid out how they connected the extortion spree to Kivimäki, a notorious hacker who was convicted in 2015 of perpetrating tens of thousands of cybercrimes, including data breaches, payment fraud, operating a botnet and calling in bomb threats.

Read more »

Vulnerability Summary for the Week of November 6, 2023
  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 1e -- platform The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. To remediate this issue download the updated Network product pack from the 1E Exchange and update the 1E-Exchange-URLResponseTime instruction to v20.1 by uploading it through the 1E Platform instruction upload UI 2023-11-06 7.2 CVE-2023-45161MISCMISC 1e -- platform The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the input parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. To remediate this issue download the updated Network product pack from the 1E Exchange and update the 1E-Exchange-CommandLinePing instruction to v18.1 by uploading it through the 1E Platform instruction upload UI 2023-11-06 7.2 CVE-2023-45163MISCMISC 1e -- platform The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. To remediate this issue DELETE the instruction "Show dialogue with caption %Caption% and message %Message%" from the list of instructions in the Settings UI, and replace it with the new instruction 1E-Exchange-ShowNotification instruction available in the updated End-User Interaction product pack. The new instruction should show as "Show %Type% type notification with header %Header% and message %Message%" with a version of 7.1 or above. 2023-11-06 7.2 CVE-2023-5964MISCMISC 7-zip -- 7-zip 7-Zip through 22.01 on Linux allows an integer underflow and code execution via a crafted 7Z archive. 2023-11-03 7.8 CVE-2023-31102MISCMISCMISC advanced_export_products_orders_cron_csv_excel_project -- advanced_export_products_orders_cron_csv_excel Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information from the ps_customer table. 2023-11-07 7.5 CVE-2023-43984 arm -- valhall_gpu_kernel_driver A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory. 2023-11-07 7.8 CVE-2023-3889 arm -- valhall_gpu_kernel_driver A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory. 2023-11-07 7.8 CVE-2023-4295 asus -- rt-ax55_firmware ASUS RT-AX55's authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services. 2023-11-03 8.8 CVE-2023-41345MISC asus -- rt-ax55_firmware ASUS RT-AX55's authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services. 2023-11-03 8.8 CVE-2023-41346MISC asus -- rt-ax55_firmware ASUS RT-AX55's authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services. 2023-11-03 8.8 CVE-2023-41347MISC asus -- rt-ax55_firmware ASUS RT-AX55's authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services. 2023-11-03 8.8 CVE-2023-41348MISC asus -- rt-ax57_firmware An issue in ASUS RT-AX57 v.3.0.0.4_386_52041 allows a remote attacker to execute arbitrary code via a crafted request to the lan_ifname field in the sub_ln 2C318 function. 2023-11-09 9.8 CVE-2023-47005 asus -- rt-ax57_firmware An issue in ASUS RT-AX57 v.3.0.0.4_386_52041 allows a remote attacker to execute arbitrary code via a crafted request to the lan_ipaddr field in the sub_6FC74 function. 2023-11-09 9.8 CVE-2023-47006 asus -- rt-ax57_firmware An issue in ASUS RT-AX57 v.3.0.0.4_386_52041 allows a remote attacker to execute arbitrary code via a crafted request to the lan_ifname field in the sub_391B8 function. 2023-11-09 9.8 CVE-2023-47007 asus -- rt-ax57_firmware An issue in ASUS RT-AX57 v.3.0.0.4_386_52041 allows a remote attacker to execute arbitrary code via a crafted request to the ifname field in the sub_4CCE4 function. 2023-11-09 9.8 CVE-2023-47008 best_courier_management_system -- best_courier_management_system An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter. 2023-11-03 9.8 CVE-2023-46980MISCMISC bestpractical -- request_tracker Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call. 2023-11-03 7.5 CVE-2023-41259MISCCONFIRMCONFIRM bestpractical -- request_tracker Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls. 2023-11-03 7.5 CVE-2023-41260MISCCONFIRMCONFIRM bestpractical -- request_tracker Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder. 2023-11-03 7.5 CVE-2023-45024MISCCONFIRM bleachbit -- bleachbit BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijacking vulnerability. By placing a DLL in the Folder c:DLLs, an attacker can run arbitrary code on every execution of BleachBit for Windows. This issue has been patched in version 4.5.0. 2023-11-08 7.3 CVE-2023-47113 boltwire -- boltwire An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function. 2023-11-07 9.1 CVE-2023-46501   botan_project -- botan bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackers to determine the cleartext password. 2023-11-03 7.5 CVE-2017-7252CONFIRMMISC clickbar -- dot-diver Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability. 2023-11-06 9.8 CVE-2023-45827MISCMISC couchbase -- couchbase_server Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal. 2023-11-08 7.5 CVE-2023-36667   djangoproject -- django In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. 2023-11-03 7.5 CVE-2023-41164CONFIRMMISC   djangoproject -- django In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. 2023-11-03 7.5 CVE-2023-43665CONFIRMMISC   ec-cube -- ec-cube EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege. 2023-11-07 7.2 CVE-2023-46845   eclipse -- glassfish In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners. 2023-11-03 9.8 CVE-2023-5763MISCMISC eclipse -- parsson In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale. 2023-11-03 7.5 CVE-2023-4043MISCMISC espressif -- esptool An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm. 2023-11-09 7.5 CVE-2023-46894 wordpress -- wordpress Cross-Site Request Forgery (CSRF) vulnerability in Alex Raven WP Report Post plugin

Read more »

Microsoft Patch Tuesday, November 2023 Edition
Microsoft today released updates to fix more than five dozen security holes in its Windows operating systems and related software, including three "zero day" vulnerabilities that Microsoft warns are already being exploited in active attacks.

Read more »

It’s Still Easy for Anyone to Become You at Experian
In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this gaping lack of security. I know that because my account at Experian was recently hijacked, and the only way I could recover access was by recreating the account.

Read more »

Who’s Behind the SWAT USA Reshipping Service?
Last week, KrebsOnSecurity broke the news that one of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. In today's Part II, we'll examine clues about the real-life identity left behind by "Fearless," the nickname chosen by the proprietor of the SWAT USA Drops service.

Read more »

Vulnerability Summary for the Week of October 30, 2023
  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info contec -- solarview_compact_firmware An issue in Contec SolarView Compact v.6.0 and before allows an attacker to execute arbitrary code via the texteditor.php component. 2023-10-27 9.8 CVE-2023-46509MISC dreamsecurity -- magicline_4.0 A Buffer overflow vulnerability in DreamSecurity MagicLine4NX versions 1.0.0.1 to 1.0.0.26 allows an attacker to remotely execute code. 2023-10-30 9.8 CVE-2023-45797MISC google -- android In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 8.8 CVE-2023-21356MISC google -- android In Bluetooth, there is a possibility of code-execution due to a use after free. This could lead to paired device escalation of privilege in the privileged Bluetooth process with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 8.8 CVE-2023-21361MISC google -- android In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 8.8 CVE-2023-40129MISCMISC google -- android In NFC, there is a possible way to setup a default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2021-39810MISC google -- android In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21351MISC google -- android In libaudioclient, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21355MISC google -- android In UWB Google, there is a possible way for a malicious app to masquerade as system app com.android.uwb.resources due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21358MISC google -- android In libdexfile, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21372MISC google -- android In Telephony, there is a possible way for a guest user to change the preferred SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21373MISC google -- android In System UI, there is a possible factory reset protection bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21374MISC google -- android In Sysproxy, there is a possible out of bounds write due to an integer underflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21375MISC google -- android In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21378MISC google -- android In Media Resource Manager, there is a possible local arbitrary code execution due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21381MISC google -- android In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7.8 CVE-2023-40116MISCMISC google -- android In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7.8 CVE-2023-40117MISCMISCMISC google -- android In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7.8 CVE-2023-40120MISCMISC google -- android In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7.8 CVE-2023-40125MISCMISC google -- android In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7.8 CVE-2023-40128MISCMISC google -- android In onBindingDied of CallRedirectionProcessor.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and background activity launch with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7.8 CVE-2023-40130MISCMISC google -- android In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.5 CVE-2023-21347MISC google -- android In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.5 CVE-2023-21353MISC google -- android In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7 CVE-2023-40131MISCMISC juzaweb -- cms An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function. 2023-10-28 7.8 CVE-2023-46468MISC projectworlds -- online_art_gallery Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'email' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-43738MISCMISC projectworlds -- online_art_gallery Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'contact' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44162MISCMISC projectworlds -- online_art_gallery Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'add1' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44375MISCMISC projectworlds -- online_art_gallery Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'add2' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44376MISCMISC projectworlds -- online_art_gallery Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'add3' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44377MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'user_email' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45012MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'user_query' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45013MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'bus_id' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45014MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'date' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45015MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'source' parameter of the search.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45016MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'destination' parameter of the search.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45017MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the includes/login.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45018MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'category' parameter of the category.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45019MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'email' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45111MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'feedback' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45112MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45113MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'subject' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45114MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the routers/add-item.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45323MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'price' parameter of the routers/add-item.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45324MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'address' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45325MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'email' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45326MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45327MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45328MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'role' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45329MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45330MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'contact' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45331MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'deleted' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45332MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'verified' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45333MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'status' parameter of the routers/edit-orders.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45334MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the routers/edit-orders.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45335MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45336MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45337MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45338MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'type' parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45339MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/details-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45340MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_price' parameter of the routers/menu-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45341MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/register-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45342MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'ticket_id' parameter of the routers/ticket-message.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45343MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_balance' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45344MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_deleted' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45345MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_role' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45346MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_verified' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45347MISCMISC radare -- radare2 An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h. 2023-10-28 9.8 CVE-2023-46569MISCMISC radare -- radare2 An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h. 2023-10-28 9.8 CVE-2023-46570MISCMISC solarwinds -- network_configuration_manager   The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. 2023-11-01 8 CVE-2023-33226MISCMISC solarwinds -- network_configuration_manager   The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability This vulnerability allows a low level user to perform the actions with SYSTEM privileges. 2023-11-01 8 CVE-2023-33227MISCMISC solarwinds -- solarwinds_platform   SolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a low-privileged user to execute commands with SYSTEM privileges. 2023-11-01 8 CVE-2023-40062MISCMISC solarwinds -- solarwinds_platform    Insecure job execution mechanism vulnerability. This vulnerability can lead to other attacks as a result. 2023-11-01 7.1 CVE-2023-40061MISC trteksolutions -- education_portal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TRtek Software Education Portal allows SQL Injection.This issue affects Education Portal: before 3.2023.29. 2023-10-27 9.8 CVE-2023-5807MISC zentao -- biz ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF). 2023-10-27 8.8 CVE-2023-46375MISC zentao -- biz Zentao Biz version 8.7 and before is vulnerable to Information Disclosure. 2023-10-27 7.5 CVE-2023-46376MISC zpesystems -- nodegrid_os ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5.2.19, v5.4.0 to v5.4.16, v5.6.0 to v5.6.13, v5.8.0 to v5.8.10, and v5.10.0 to v5.10.3 was discovered to contain a command injection vulnerability via the endpoint /v1/system/toolkit/files/. 2023-10-28 8.8 CVE-2023-43322CONFIRM Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- acrobat_for_edge   Adobe Acrobat for Edge version 118.0.2088.46 (and earlier) is affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-10-30 5.5 CVE-2023-44323MISC color -- demoiccmax In International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut.cpp in libSampleICC.a attempts to access array elements at out-of-bounds indexes. 2023-10-30 6.5 CVE-2023-46866MISCMISC color -- demoiccmax In International Color Consortium DemoIccMAX 79ecb74, CIccXformMatrixTRC::GetCurve in IccCmm.cpp in libSampleICC.a has a NULL pointer dereference. 2023-10-30 6.5 CVE-2023-46867MISCMISC flusity -- flusity A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument edit_post_id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 6943991c62ed87c7a57989a0cb7077316127def8. It is recommended to apply a patch to fix this issue. The identifier VDB-243641 was assigned to this vulnerability. 2023-10-27 4.8 CVE-2023-5810MISCMISCMISCMISC google -- android In Bluetooth, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 6.7 CVE-2023-21360MISC google -- android In the Security Element API, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 6.7 CVE-2023-21370MISC google -- android In Secure Element, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 6.7 CVE-2023-21371MISC google -- android In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 6.7 CVE-2023-21380MISC google -- android In Bluetooth, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 6.5 CVE-2023-21395MISC google -- android In Slice, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21294MISC google -- android In Media Projection, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21350MISC google -- android In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21352MISC google -- android In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21354MISC google -- android In Usage, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21362MISC google -- android In ContactsProvider, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21364MISC google -- android In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21365MISC google -- android In Scudo, there is a possible way for an attacker to predict heap allocation patterns due to insecure implementation/design. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21366MISC google -- android In Scudo, there is a possible way to exploit certain heap OOB read/write issues due to an insecure implementation/design. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21367MISC google -- android In Audio, there is a possible out of bounds read due to missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21368MISC google -- android In Usage Access, there is a possible way to display a Settings usage access restriction toggle screen due to a permissions bypass. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. 2023-10-30 5.5 CVE-2023-21369MISC google -- android In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21376MISC google -- android In SELinux Policy, there is a possible restriction bypass due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21377MISC google -- android In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21382MISC google -- android In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. 2023-10-30 5.5 CVE-2023-21383MISC google -- android In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21384MISC google -- android In Whitechapel, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21385MISC google -- android In Telecomm, there is a possible bypass of a multiuser security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21394MISC google -- android In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 5.5 CVE-2023-40121MISCMISC google -- android In updateActionViews of PipMenuView.java, there is a possible bypass of a multiuser security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 5.5 CVE-2023-40123MISCMISC google -- android In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 5.5 CVE-2023-40133MISCMISC google -- android In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 4.4 CVE-2023-21357MISC google -- android In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 4.4 CVE-2023-21359MISC google -- android In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 4.4 CVE-2023-21379MISC gougucms -- gougucms A stored cross-site scripting (XSS) vulnerability in /home/user/edit_submit of gougucms v4.08.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the headimgurl parameter. 2023-10-27 5.4 CVE-2023-46394MISC lenovo -- thinkpad_e14_firmware An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code. 2023-10-30 6.7 CVE-2022-48189MISC lenovo -- thinkpad_x1_fold_gen_1_firmware An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code. 2023-10-30 6.7 CVE-2022-4573MISC macwk -- icecms IceCMS v2.0.1 is vulnerable to Cross Site Request Forgery (CSRF). 2023-10-27 6.5 CVE-2023-42188MISCMISC projectworlds -- online_blood_donation_management_system   Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The 'firstName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response. 2023-10-31 6.1 CVE-2023-44484MISCMISC projectworlds -- online_blood_donation_management_system   Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The 'lastName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response. 2023-10-31 6.1 CVE-2023-44485MISCMISC projectworlds -- online_blood_donation_management_system   Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The 'address' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response. 2023-10-31 6.1 CVE-2023-44486MISCMISC projectworlds -- online_blood_donation_management_system   Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The 'city' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response. 2023-10-31 6.1 CVE-2023-5306MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the admin.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL. 2023-11-01 6.1 CVE-2023-45201MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the feed.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL. 2023-11-01 6.1 CVE-2023-45202MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the login.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL. 2023-11-01 6.1 CVE-2023-45203MISCMISC pwncyn -- fancms Cross Site Scripting vulnerability in FanCMS v.1.0.0 allows an attacker to execute arbitrary code via the content1 parameter in the demo.php file. 2023-10-27 6.1 CVE-2023-46505MISC pwncyn -- yxbookcms Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a remote attacker to execute arbitrary code via the reader management and book input modules. 2023-10-27 6.1 CVE-2023-46503MISC pwncyn -- yxbookcms Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a physically proximate attacker to execute arbitrary code via the library name function in the general settings component. 2023-10-27 5.4 CVE-2023-46504MISC solarwinds -- network_configuration_manager   The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information. 2023-11-01 4.5 CVE-2023-33228MISCMISC wordpress -- wordpress The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2023-10-27 6.5 CVE-2023-5821MISCMISCMISC wordpress -- wordpress Unauth. Stored Cross-Site Scripting (XSS) vulnerability in UserFeedback Team User Feedback plugin

Read more »

Russian Reshipping Service ‘SWAT USA Drop’ Exposed
One of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. Here’s a closer look at the Russia-based SWAT USA Drop Service, which currently employs more than 1,200 people across the United States who are knowingly or unwittingly involved in reshipping expensive consumer goods purchased with stolen credit cards.

Read more »

.US Harbors Prolific Malicious Link Shortening Service
The top-level domain for the United States -- .US -- is home to thousands of newly-registered domains tied to a malicious link shortening service that facilitates malware and phishing scams, new research suggests. The findings come close on the heels of a report that identified .US domains as among the most prevalent in phishing attacks over the past year.

Read more »

Vulnerability Summary for the Week of October 23, 2023
  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info projectworlds_pvt._limited -- online_art_gallery   Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'fnm' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-26 9.8 CVE-2023-43737MISCMISC projectworlds_pvt._limited -- online_art_gallery   Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'email' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-43738MISCMISC projectworlds_pvt._limited -- online_art_gallery   Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'contact' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44162MISCMISC projectworlds_pvt._limited -- online_art_gallery   Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'lnm' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-26 9.8 CVE-2023-44267MISCMISC projectworlds_pvt._limited -- online_art_gallery   Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'gender' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-26 9.8 CVE-2023-44268MISCMISC projectworlds_pvt._limited -- online_art_gallery   Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'add1' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44375MISCMISC projectworlds_pvt._limited -- online_art_gallery   Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'add2' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44376MISCMISC projectworlds_pvt._limited -- online_art_gallery   Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'add3' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44377MISCMISC apache -- http_server Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.57. 2023-10-23 9.1 CVE-2023-31122MISCMISCMISC byzoro -- smart_s85f_firmware A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btn_file_renew leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-10-21 9.8 CVE-2023-5683MISCMISCMISC byzoro -- smart_s85f_firmware A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243061 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-10-21 9.8 CVE-2023-5684MISCMISCMISC calibre-ebook -- calibre link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root. 2023-10-22 7.5 CVE-2023-46303MISCMISC codeastro -- internet_banking_system A vulnerability was found in CodeAstro Internet Banking System 1.0 and classified as critical. This issue affects some unknown processing of the file pages_reset_pwd.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243131. 2023-10-22 9.8 CVE-2023-5693MISCMISCMISC color -- demoiccmax In International Color Consortium DemoIccMAX 79ecb74, there is a stack-based buffer overflow in the icFixXml function in IccXML/IccLibXML/IccUtilXml.cpp in libIccXML.a. 2023-10-23 8.8 CVE-2023-46602MISC color -- demoiccmax In International Color Consortium DemoIccMAX 79ecb74, there is an out-of-bounds read in the CIccPRMG::GetChroma function in IccProfLib/IccPrmg.cpp in libSampleICC.a. 2023-10-23 7.8 CVE-2023-46603MISC dell -- unity_operating_environment Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability. This could allow an authenticated, local attacker to exploit this vulnerability by authenticating to the device CLI and issuing certain commands. 2023-10-23 7.8 CVE-2023-43066MISC dell -- unity_operating_environment Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by crafting arbitrary files through a request to the server. 2023-10-23 7.5 CVE-2023-43074MISC edm_informatics -- e-invoice   Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. This issue affects E-invoice: before 2.1. 2023-10-27 7.5 CVE-2023-5443MISC f5 -- big-ip Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated 2023-10-26 9.8 CVE-2023-46747MISC f5 -- big-ip An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated 2023-10-26 8.8 CVE-2023-46748MISC frostming -- pdm pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious `pdm.lock` file that could allow e.g., an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project `foo` can be targeted by creating the project `foo-2` and uploading the file `foo-2-2.tar.gz` to pypi.org. PyPI will see this as project `foo-2` version `2`, while PDM will see this as project `foo` version `2-2`. The version must only be `parseable as a version` and the filename must be a prefix of the project name, but it's not verified to match the version being installed. Version `2-2` is also not a valid normalized version per PEP 440. Matching the project name exactly (not just prefix) would fix the issue. When installing dependencies with PDM, what's actually installed could differ from what's listed in `pyproject.toml` (including arbitrary code execution on install). It could also be used for downgrade attacks by only changing the version. This issue has been addressed in commit `6853e2642df` which is included in release version `2.9.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability. 2023-10-20 7.8 CVE-2023-45805MISCMISCMISCMISCMISC ibm -- cognos_dashboards_on_cloud_pak_for_data IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in container images which could lead to further attacks against the system. IBM X-Force ID: 260730. 2023-10-22 7.5 CVE-2023-38275MISCMISC ibm -- cognos_dashboards_on_cloud_pak_for_data IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in environment variables which could aid in further attacks against the system. IBM X-Force ID: 260736. 2023-10-22 7.5 CVE-2023-38276MISCMISC ibm -- security_verify_governance IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 225222. 2023-10-23 9.8 CVE-2022-22466MISCMISC ibm -- security_verify_governance IBM Security Verify Governance 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 256036. 2023-10-23 8.8 CVE-2023-33839MISCMISC ibm -- security_verify_governance IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission. IBM X-Force ID: 256020. 2023-10-23 7.5 CVE-2023-33837MISCMISC ibm -- sterling_partner_engagement_manager IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896. 2023-10-23 7.5 CVE-2023-43045MISCMISC idattend -- idweb Unauthenticated SQL injection in the GetStudentGroupStudents method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. 2023-10-25 9.1 CVE-2023-26568MISC idattend -- idweb Unauthenticated SQL injection in the StudentPopupDetails_Timetable method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. 2023-10-25 9.1 CVE-2023-26569MISC idattend -- idweb Unauthenticated SQL injection in the GetExcursionList method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. 2023-10-25 9.1 CVE-2023-26572MISC idattend -- idweb Missing authentication in the SetDB method in IDAttend's IDWeb application 3.1.052 and earlier allows denial of service or theft of database login credentials. 2023-10-25 9.1 CVE-2023-26573MISC idattend -- idweb Unauthenticated SQL injection in the GetVisitors method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. 2023-10-25 9.1 CVE-2023-26581MISC idattend -- idweb Unauthenticated SQL injection in the GetExcursionDetails method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. 2023-10-25 9.1 CVE-2023-26582MISC idattend -- idweb Unauthenticated SQL injection in the GetCurrentPeriod method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. 2023-10-25 9.1 CVE-2023-26583MISC idattend -- idweb Unauthenticated SQL injection in the GetStudentInconsistencies method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. 2023-10-25 9.1 CVE-2023-26584MISC idattend -- idweb Unauthenticated SQL injection in the GetRoomChanges method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. 2023-10-25 9.1 CVE-2023-27254MISC idattend -- idweb Unauthenticated SQL injection in the DeleteRoomChanges method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. 2023-10-25 9.1 CVE-2023-27255MISC idattend -- idweb Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. 2023-10-25 9.1 CVE-2023-27260MISC idattend -- idweb Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers. 2023-10-25 9.1 CVE-2023-27262MISC idattend -- idweb Arbitrary file upload to web root in the IDAttend's IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server. 2023-10-25 8.8 CVE-2023-26578MISC idattend -- idweb Missing authentication in the StudentPopupDetails_Timetable method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers. 2023-10-25 7.5 CVE-2023-26570MISC idattend -- idweb Missing authentication in the SetStudentNotes method in IDAttend's IDWeb application 3.1.052 and earlier allows modification of student data by unauthenticated attackers. 2023-10-25 7.5 CVE-2023-26571MISC idattend -- idweb Missing authentication in the SearchStudents method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers. 2023-10-25 7.5 CVE-2023-26574MISC idattend -- idweb Missing authentication in the SearchStudentsStaff method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction sensitive student and teacher data by unauthenticated attackers. 2023-10-25 7.5 CVE-2023-26575MISC idattend -- idweb Missing authentication in the SearchStudentsRFID method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers. 2023-10-25 7.5 CVE-2023-26576MISC idattend -- idweb Unauthenticated arbitrary file read in the IDAttend's IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated attackers. 2023-10-25 7.5 CVE-2023-26580MISC idattend -- idweb Missing authentication in the GetActiveToiletPasses method in IDAttend's IDWeb application 3.1.052 and earlier allows retrieval of student information by unauthenticated attackers. 2023-10-25 7.5 CVE-2023-27257MISC idattend -- idweb Missing authentication in the GetStudentGroupStudents method in IDAttend's IDWeb application 3.1.052 and earlier allows retrieval of student and teacher data by unauthenticated attackers. 2023-10-25 7.5 CVE-2023-27258MISC idattend -- idweb Missing authentication in the GetAssignmentsDue method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction of sensitive student and teacher data by unauthenticated attackers. 2023-10-25 7.5 CVE-2023-27259MISC idattend -- idweb Missing authentication in the StudentPopupDetails_ContactDetails method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers. 2023-10-25 7.5 CVE-2023-27375MISC idattend -- idweb Missing authentication in the StudentPopupDetails_StudentDetails method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers. 2023-10-25 7.5 CVE-2023-27376MISC idattend -- idweb Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend's IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers. 2023-10-25 7.5 CVE-2023-27377MISC inohom -- home_manager_gateway   Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. This issue affects Home Manager Gateway: before v.1.27.12. 2023-10-27 7.5 CVE-2023-5570MISC langchain -- langchain In Langchain through 0.0.155, prompt injection allows execution of arbitrary code against the SQL service provided by the chain. 2023-10-20 9.8 CVE-2023-32785MISC langchain -- langchain In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks. 2023-10-20 7.5 CVE-2023-32786MISC m-files -- web_companion Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution  2023-10-20 7.8 CVE-2023-5523MISC modoboa -- modoboa Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2. 2023-10-20 8.8 CVE-2023-5690MISCMISC mosparo -- mosparo Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3. 2023-10-20 8.8 CVE-2023-5687MISCMISC netentsec -- application_security_gateway A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /protocol/iscgwtunnel/uploadiscgwrouteconf.php. The manipulation of the argument GWLinkId leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-243138 is the identifier assigned to this vulnerability. 2023-10-23 9.8 CVE-2023-5700MISCMISCMISC netentsec -- application_security_gateway A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_addr_fwresource_ip.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243057 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-10-20 7.2 CVE-2023-5681MISCMISCMISC openimageio -- openimageio An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the read_rle_image function of file bifs/unquantize.c 2023-10-23 8.8 CVE-2023-42295MISC pleaser -- pleaser please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.) 2023-10-20 7.8 CVE-2023-46277MISCMISCMISCMISC projectworlds_pvt._limited -- leave_management_system_project   Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setcasualleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44480MISCMISC qnap -- qusbcam2 An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: QUSBCam2 2.0.3 ( 2023/06/15 ) and later 2023-10-20 8.8 CVE-2023-23373MISC radare -- radare2 Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. 2023-10-20 8.8 CVE-2023-5686MISCMISC reconftw -- reconftw reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities. A vulnerability has been identified in reconftw where inadequate validation of retrieved subdomains may lead to a Remote Code Execution (RCE) attack. An attacker can exploit this vulnerability by crafting a malicious CSP entry on it's own domain. Successful exploitation can lead to the execution of arbitrary code within the context of the application, potentially compromising the system. This issue has been addressed in version 2.7.1.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2023-10-20 8.8 CVE-2023-46117MISCMISC secudos -- qiata SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker needs access as a low-privileged user to the underlying DOMOS system. Every user on the system has write permission for previewRm.sh, which is executed by the root user. 2023-10-20 7.8 CVE-2023-40361MISC silabs -- gecko_bootloader An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots. 2023-10-20 7.8 CVE-2023-3487MISCMISC sitolog -- sitolog_application_connect Sitolog sitologapplicationconnect v7.8.a and before was discovered to contain a SQL injection vulnerability via the component /activate_hook.php. 2023-10-20 9.8 CVE-2023-37824MISC sollace -- unicopia Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute arbitrary code. 2023-10-20 9.8 CVE-2023-39680MISC stb_image.h -- stb_image.h stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn't give guarantees about the content of output value `*delays` upon failure. Although it sets `*delays` to zero at the beginning, it doesn't do it in case the image is not recognized as GIF and a call to `stbi__load_gif_main_outofmem` only frees possibly allocated memory in `*delays` without resetting it to zero. It would be fair to say the caller of `stbi__load_gif_main` is responsible to free the allocated memory in `*delays` only if `stbi__load_gif_main` returns a non-null value. However, at the same time the function may return null value but fail to free the memory in `*delays` if internally `stbi__convert_format` is called and fails. The issue may lead to a memory leak if the caller chooses to free `delays` only when `stbi__load_gif_main` didn't fail or to a double-free if the `delays` is always freed 2023-10-21 9.8 CVE-2023-45666MISCMISCMISC stb_image.h -- stb_image.h stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first "free", the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution. 2023-10-21 8.8 CVE-2023-45664MISCMISC stb_image.h -- stb_image.h stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn't match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger `memcpy` out-of-bounds read because `bytes_per_pixel` used to calculate `bytes_per_row` doesn't match the real image array dimensions. 2023-10-21 8.1 CVE-2023-45662MISCMISC stb_image.h -- stb_image.h stb_image is a single file MIT licensed library for processing images. If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails, it returns a null pointer and may keep the `z` variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls `stbi__vertical_flip_slices` with the null pointer result value and the uninitialized `z` value. This may result in a program crash. 2023-10-21 7.5 CVE-2023-45667MISCMISCMISC stb_image.h -- stb_image.h stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information. 2023-10-21 7.1 CVE-2023-45661MISCMISCMISC stb_image.h -- stb_vorbis.c stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f- >vendor[i] = get8_packet(f);`. The root cause is an integer overflow in `setup_malloc`. A sufficiently large value in the variable `sz` overflows with `sz+7` in and the negative value passes the maximum available memory buffer check. This issue may lead to code execution. 2023-10-21 7.8 CVE-2023-45676MISCMISCMISC stb_image.h -- stb_vorbis.c stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f- >vendor[len] = (char)'';`. The root cause is that if `len` read in `start_decoder` is a negative number and `setup_malloc` successfully allocates memory in that case, but memory write is done with a negative index `len`. Similarly if len is INT_MAX the integer overflow len+1 happens in `f- >vendor = (char*)setup_malloc(f, sizeof(char) * (len+1));` and `f- >comment_list[i] = (char*)setup_malloc(f, sizeof(char) * (len+1));`. This issue may lead to code execution. 2023-10-21 7.8 CVE-2023-45677MISCMISCMISCMISCMISCMISC stb_image.h -- stb_vorbis.c stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at maximum `m- >submaps` can be 16 but `submap_floor` and `submap_residue` are declared as arrays of 15 elements. This issue may lead to code execution. 2023-10-21 7.8 CVE-2023-45678MISCMISCMISC stb_image.h -- stb_vorbis.c stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, but some of the pointers in `f- >comment_list` are left initialized and later `setup_free` is called on these pointers in `vorbis_deinit`. This issue may lead to code execution. 2023-10-21 7.8 CVE-2023-45679MISCMISCMISC stb_image.h -- stb_vorbis.c stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char*) * (f- >comment_list_length)` which may make `setup_malloc` allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution. 2023-10-21 7.8 CVE-2023-45681MISCMISC stb_image.h -- stb_vorbis.c stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds read in `DECODE` macro when `var` is negative. As it can be seen in the definition of `DECODE_RAW` a negative `var` is a valid value. This issue may be used to leak internal memory allocation information. 2023-10-21 7.1 CVE-2023-45682MISCMISCMISCMISC stb_image.h -- stb_vorbis.c stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f- >vendor[len] = (char)'';`. The root cause is that if the len read in `start_decoder` is `-1` and `len + 1` becomes 0 when passed to `setup_malloc`. The `setup_malloc` behaves differently when `f- >alloc.alloc_buffer` is pre-allocated. Instead of returning `NULL` as in `malloc` case it shifts the pre-allocated buffer by zero and returns the currently available memory block. This issue may lead to code execution. 2023-10-21 7.8 CVE-2023-45675MISCMISCMISCMISC superwebmailer -- superwebmailer An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter. 2023-10-21 8.8 CVE-2023-38190MISCMISC superwebmailer -- superwebmailer An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line. 2023-10-21 8.8 CVE-2023-38193MISCMISC thingnario -- photon An issue in ThingNario Photon v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the ping function to the "thingnario Logger Maintenance Webpage" endpoint. 2023-10-21 8.8 CVE-2023-46055MISC tongda -- oa A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/training/record/delete.php. The manipulation of the argument RECORD_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-243058 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-10-20 9.8 CVE-2023-5682MISCMISCMISC totolink -- a3700r_firmware An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function. 2023-10-25 9.8 CVE-2023-46574MISC totolink -- x2000r_firmware TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDel. 2023-10-25 9.8 CVE-2023-46554MISCMISC totolink -- x2000r_firmware TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPortFw. 2023-10-25 9.8 CVE-2023-46555MISCMISC totolink -- x2000r_firmware TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formFilter. 2023-10-25 9.8 CVE-2023-46556MISCMISC totolink -- x2000r_firmware TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAPVLAN. 2023-10-25 9.8 CVE-2023-46557MISCMISC totolink -- x2000r_firmware TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice. 2023-10-25 9.8 CVE-2023-46558MISCMISC totolink -- x2000r_firmware TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIPv6Addr. 2023-10-25 9.8 CVE-2023-46559MISCMISC totolink -- x2000r_firmware TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup. 2023-10-25 9.8 CVE-2023-46560MISCMISC totolink -- x2000r_firmware TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg. 2023-10-25 9.8 CVE-2023-46562MISCMISC totolink -- x2000r_firmware TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS. 2023-10-25 9.8 CVE-2023-46563MISCMISC totolink -- x2000r_firmware TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDMZ. 2023-10-25 9.8 CVE-2023-46564MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function uninstallPluginReqHandle. 2023-10-25 9.8 CVE-2023-46520MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function RegisterRegister. 2023-10-25 9.8 CVE-2023-46521MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function deviceInfoRegister. 2023-10-25 9.8 CVE-2023-46522MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function upgradeInfoRegister. 2023-10-25 9.8 CVE-2023-46523MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function loginRegister. 2023-10-25 9.8 CVE-2023-46525MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function resetCloudPwdRegister. 2023-10-25 9.8 CVE-2023-46526MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function bindRequestHandle. 2023-10-25 9.8 CVE-2023-46527MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function modifyAccPwdRegister. 2023-10-25 9.8 CVE-2023-46534MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getResetVeriRegister. 2023-10-25 9.8 CVE-2023-46535MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkRegVeriRegister. 2023-10-25 9.8 CVE-2023-46536MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getRegVeriRegister. 2023-10-25 9.8 CVE-2023-46537MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkResetVeriRegister. 2023-10-25 9.8 CVE-2023-46538MISCMISC tp-link -- tl-wr886n_firmware TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function registerRequestHandle. 2023-10-25 9.8 CVE-2023-46539MISCMISC trtek_software -- education_portal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TRtek Software Education Portal allows SQL Injection. This issue affects Education Portal: before 3.2023.29. 2023-10-27 9.8 CVE-2023-5807MISC vercel -- next.js Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. 2023-10-22 7.5 CVE-2023-46298MISCMISCMISC vmware -- fusion VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time. 2023-10-20 7.8 CVE-2023-34045MISC vmware -- fusion VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time. 2023-10-20 7 CVE-2023-34046MISC wallix -- bastion WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access administration web interface. 2023-10-23 7.5 CVE-2023-46319MISC wordpress -- wordpress The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins (present and active), active theme, various plugin settings, WordPress version, as well as some server settings such as memory limit, installation paths. 2023-10-20 7.5 CVE-2023-4668MISCMISC wordpress -- wordpress The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the 'zbscrmcsvimpf' parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon a failed check. These steps then perform a 'file_exists' check on the value of 'zbscrmcsvimpf'. If a phar:// archive is supplied, its contents will be deserialized and an object injected in the execution stream. This allows an unauthenticated attacker to obtain object injection if they are able to upload a phar archive (for instance if the site supports image uploads) and then trick an administrator into performing an action, such as clicking a link. 2023-10-20 8.8 CVE-2022-3342MISCMISCMISC wordpress -- wordpress The Brizy plugin for WordPress is vulnerable to authorization bypass due to an incorrect capability check on the is_administrator() function in versions up to, and including, 1.0.125. This makes it possible for authenticated attackers to access and interact with available AJAX functions. 2023-10-20 8.1 CVE-2020-36714MISCMISC wordpress -- wordpress The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is due to missing capability checks on several AJAX actions and nonce disclosure in the source page of the administrative dashboard. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to call functions and delete and/or upload files. 2023-10-20 8.8 CVE-2020-36698MISCMISCMISC wordpress -- wordpress The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, and including, 3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This potentially allows authenticated users with the ability to add or modify terms or tags to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A partial patch became available in version 3.6 and the issue was fully patched in version 3.7. 2023-10-20 8.8 CVE-2022-4290MISCMISC wordpress -- wordpress The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's [horizontal-scrolling] shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2023-10-20 8.8 CVE-2023-4999MISCMISC wordpress -- wordpress The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included. 2023-10-20 9.8 CVE-2023-4488MISCMISC wordpress -- wordpress The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs function. This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information including those belonging to other sites, for example in shared hosting environments. 2023-10-20 7.2 CVE-2023-5414MISCMISCMISC wordpress -- wordpress The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server. 2023-10-20 8.8 CVE-2022-2441MISCMISCMISCMISCMISCMISC wordpress -- wordpress Cross-Site Request Forgery (CSRF) vulnerability in PluginEver WC Serial Numbers plugin alert(9206)

Read more »

NJ Man Hired Online to Firebomb, Shoot at Homes Gets 13 Years in Prison
A 22-year-old New Jersey man has been sentenced to more than 13 years in prison for participating in a firebombing and a shooting at homes in Pennsylvania last year. Patrick McGovern-Allen was the subject of a Sept. 4, 2022 story here about the emergence of "violence-as-a-service" offerings, where random people from the Internet hire themselves out to perform a variety of local, physical attacks, including firebombing a home, "bricking" windows, slashing tires, or performing a drive-by shooting at someone's residence.

Read more »

Vulnerability Summary for the Week of October 16, 2023
High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 1e -- platform Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Application of the relevant hotfix remediates this issue. for v8.1.2 apply hotfix Q23166 for v8.4.1 apply hotfix Q23164 for v9.0.1 apply hotfix Q23169 SaaS implementations on v23.7.1 will automatically have hotfix Q23173 applied. Customers with SaaS versions below this are urged to upgrade urgently - please contact 1E to arrange this 2023-10-13 9.8 CVE-2023-45162MISC advantech -- webaccess Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user credentials. 2023-10-17 7.5 CVE-2023-4215MISC apache -- inlong Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile".... Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8604 2023-10-16 9.8 CVE-2023-43668MISC apache -- inlong Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false records, making it harder to audit and trace malicious activities. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8628 2023-10-16 7.5 CVE-2023-43667MISC apache -- traffic_server Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue. 2023-10-17 7.5 CVE-2023-39456MISCMISCMISC apache -- traffic_server Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue. 2023-10-17 7.5 CVE-2023-41752MISCMISCMISC axis -- axis_os GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. The application handling service in AXIS OS was vulnerable to command injection allowing an attacker to run arbitrary code. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. 2023-10-16 7.2 CVE-2023-21413MISC axis -- axis_os_2022 Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. 2023-10-16 8.1 CVE-2023-21415MISC dell -- emc_openmanage_server_administrator Dell OpenManage Server Administrator, versions 11.0.0.0 and prior, contains an Improper Access Control vulnerability. A local low-privileged malicious user could potentially exploit this vulnerability to execute arbitrary code in order to elevate privileges on the system. Exploitation may lead to a complete system compromise. 2023-10-13 7.8 CVE-2023-43079MISC devolutions -- devolutions_server Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and earlier allows an attack with permission to manage PAM propagation scripts to retrieve passwords stored in it via a GET request. 2023-10-13 7.5 CVE-2023-5240MISC discourse -- discourse Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to temporarily work around this problem by reducing the `client_max_body_size nginx directive`. `client_max_body_size` will limit the size of uploads that can be uploaded directly to the server. 2023-10-16 7.5 CVE-2023-44388MISCMISC discourse -- discourse Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability. 2023-10-16 7.5 CVE-2023-45131MISC d-link -- dar-7000_firmware D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php. 2023-10-17 9.8 CVE-2023-44693MISC d-link -- dar-7000_firmware D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /log/mailrecvview.php. 2023-10-17 9.8 CVE-2023-44694MISC d-link -- di-7003g_firmware Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the fn parameter of the tgfile.htm function. 2023-10-16 9.8 CVE-2023-45572MISC d-link -- di-7003g_firmware Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the n parameter of the mrclfile_del.asp function. 2023-10-16 9.8 CVE-2023-45573MISC d-link -- di-7003g_firmware Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the fn parameter of the file.data function. 2023-10-16 9.8 CVE-2023-45574MISCMISC d-link -- di-7003g_firmware Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the ip parameter of the ip_position.asp function. 2023-10-16 9.8 CVE-2023-45575MISC d-link -- di-7003g_firmware Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the remove_ext_proto/remove_ext_port parameter of the upnp_ctrl.asp function. 2023-10-16 9.8 CVE-2023-45576MISC d-link -- di-7003g_firmware Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the wanid parameter of the H5/speedlimit.data function. 2023-10-16 9.8 CVE-2023-45577MISC d-link -- di-7003g_firmware Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the pap_en/chap_en parameter of the pppoe_base.asp function. 2023-10-16 9.8 CVE-2023-45578MISC d-link -- di-7003g_firmware Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the ip/type parameter of the jingx.asp function. 2023-10-16 9.8 CVE-2023-45579MISC d-link -- di-7003g_firmware Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the wild/mx and other parameters of the ddns.asp function 2023-10-16 9.8 CVE-2023-45580MISC d-link -- dir-820l_firmware D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function. 2023-10-16 9.8 CVE-2023-44808MISC d-link -- dir-820l_firmware D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions. 2023-10-16 9.8 CVE-2023-44809MISC dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/category/add. 2023-10-17 8.8 CVE-2023-45901MISC dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/attachment/delete. 2023-10-17 8.8 CVE-2023-45902MISC dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/label/delete. 2023-10-17 8.8 CVE-2023-45903MISC dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update. 2023-10-17 8.8 CVE-2023-45904MISC dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/add. 2023-10-17 8.8 CVE-2023-45905MISC dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/user/add. 2023-10-17 8.8 CVE-2023-45906MISC dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/delete. 2023-10-17 8.8 CVE-2023-45907MISC easyuse -- mailhunter_ultimate Unrestricted upload of file with dangerous type vulnerability in create template function in EasyUse MailHunter Ultimate 2023 and earlier allows remote authenticated users to perform arbitrary system commands with 'NT AuthoritySYSTEM' privilege via a crafted ZIP archive. 2023-10-17 8.8 CVE-2023-34207MISC easyuse -- mailhunter_ultimate SQL Injection in create customer group function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to execute arbitrary SQL commands via the ctl00$ContentPlaceHolder1$txtCustSQL parameter. 2023-10-17 8.8 CVE-2023-34210MISC fiber -- fiber Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This issue has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes as defense in depth measures. There are no known workarounds for this vulnerability. 2023-10-16 9.8 CVE-2023-45128MISCMISC fortinet -- fortiedr A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands via api request 2023-10-13 8.1 CVE-2023-33303MISC fortinet -- fortisandbox A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 2.5.0 through 2.5.2 and 2.4.1 and 2.4.0 allows attacker to denial of service via crafted http requests. 2023-10-13 7.5 CVE-2023-41682MISC freshtomato -- freshtomato An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability. 2023-10-16 9.8 CVE-2023-3991MISC gnome -- tracker_miners A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability. 2023-10-13 7.7 CVE-2023-5557MISCMISC gpac -- gpac NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV. 2023-10-15 7.8 CVE-2023-5586MISCMISC grafana -- grafana Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It also allows an Organization Admin to assign or revoke any permissions that they have to any user globally. Any Organization Admin can elevate their own permissions or elevate or restrict the permissions of any other user. The vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of. 2023-10-16 7.2 CVE-2023-4822MISC grafana -- grafana Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability. The plugin did not properly sanitize error messages, making it potentially expose the Google Sheet API-key that is configured for the data source. This vulnerability was fixed in version 1.2.2. 2023-10-16 7.5 CVE-2023-4457MISC hp -- thinupdate A potential security vulnerability has been identified in the HP ThinUpdate utility (also known as HP Recovery Image and Software Download Tool) which may lead to information disclosure. HP is releasing mitigation for the potential vulnerability. 2023-10-13 7.5 CVE-2023-4499MISC ibm -- cloud_pak_for_business_automation IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 258349. 2023-10-14 7.6 CVE-2023-35024MISCMISC ibm -- db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain databases. IBM X-Force ID: 253440. 2023-10-16 7.5 CVE-2023-30987MISCMISC ibm -- db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 254037. 2023-10-16 7.5 CVE-2023-30991MISCMISC ibm -- db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to denial of service with a specially crafted ALTER TABLE statement. IBM X-Force ID: 261616. 2023-10-16 7.5 CVE-2023-38720MISCMISC ibm -- db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted XML query statement. IBM X-Force ID: 262258. 2023-10-16 7.5 CVE-2023-38728MISCMISCMISC ibm -- db2 IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted SQL statement. IBM X-Force ID: 262613. 2023-10-16 7.5 CVE-2023-38740MISCMISCMISC ibm -- db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted SQL statement using External Tables. IBM X-Force ID: 263499. 2023-10-17 7.5 CVE-2023-40372MISCMISC ibm -- db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted query containing common table expressions. IBM X-Force ID: 263574. 2023-10-17 7.5 CVE-2023-40373MISCMISC ibm -- db2 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted query statement. IBM X-Force ID: 263575. 2023-10-16 7.5 CVE-2023-40374MISCMISC ibm -- hardware_management_console IBM HMC (Hardware Management Console) 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 260740. 2023-10-16 7.8 CVE-2023-38280MISCMISC ibm -- i Backup, Recovery, and Media Services (BRMS) for IBM i 7.2, 7.3, and 7.4 contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system. IBM X-Force ID: 263583. 2023-10-16 7.8 CVE-2023-40377MISCMISC ibm -- i IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system. IBM X-Force ID: 263584. 2023-10-15 7.8 CVE-2023-40378MISCMISC ibm -- qradar_security_information_and_event_manager IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 254138 2023-10-14 7.5 CVE-2023-30994MISCMISC ibm -- security_directory_integrator IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 228582. 2023-10-14 7.5 CVE-2022-33165MISCMISCMISC ibm -- security_directory_server IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228505. 2023-10-14 9.1 CVE-2022-32755MISCMISC ibm -- security_verify_access_oidc_provider IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 238921. 2023-10-14 7.5 CVE-2022-43740MISCMISC ibm -- security_verify_governance IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 256016. 2023-10-16 9.8 CVE-2023-33836MISCMISC ibm -- security_verify_governance IBM Security Verify Governance 10.0 could allow a privileged use to upload arbitrary files due to improper file validation. IBM X-Force ID: 259382. 2023-10-16 7.2 CVE-2023-35018MISCMISC ibm -- security_verify_privilege_on-premises IBM Security Verify Privilege On-Premises 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 221681. 2023-10-17 8.8 CVE-2022-22375MISCMISC ibm -- security_verify_privilege_on-premises IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information to an attacked due to the transmission of data in clear text. IBM X-Force ID: 221962. 2023-10-17 7.5 CVE-2022-22385MISCMISC ibm -- security_verify_privilege_on-premises IBM Security Verify Privilege On-Premise 11.5 could allow an authenticated user to obtain sensitive information or perform unauthorized actions due to improper input validation. IBM X-Force ID: 207898. 2023-10-17 7.1 CVE-2021-29913MISCMISC juniper -- junos An Unchecked Return Value vulnerability in the user interfaces to the Juniper Networks Junos OS and Junos OS Evolved, the CLI, the XML API, the XML Management Protocol, the NETCONF Management Protocol, the gNMI interfaces, and the J-Web User Interfaces causes unintended effects such as demotion or elevation of privileges associated with an operator's actions to occur. Multiple scenarios may occur; for example: privilege escalation over the device or another account, access to files that should not otherwise be accessible, files not being accessible where they should be accessible, code expected to run as non-root may run as root, and so forth. This issue affects: Juniper Networks Junos OS * All versions prior to 20.4R3-S7; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S4; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R3-S2; * 22.2 versions prior to 22.2R2-S2, 22.2R3; * 22.3 versions prior to 22.3R1-S2, 22.3R2. Juniper Networks Junos OS Evolved * All versions prior to 21.4R3-S3-EVO; * 22.1-EVO version 22.1R1-EVO and later versions prior to 22.2R2-S2-EVO, 22.2R3-EVO; * 22.3-EVO versions prior to 22.3R1-S2-EVO, 22.3R2-EVO. 2023-10-13 8.8 CVE-2023-44182MISCMISCMISC juniper -- junos An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a backdoor with root privileges. The issue is caused by improper directory permissions on a certain system directory, allowing an attacker with access to this directory to create a backdoor with root privileges. This issue affects Juniper Networks Junos OS: * All versions prior to 20.4R3-S5; * 21.1 versions prior to 21.1R3-S4; * 21.2 versions prior to 21.2R3-S4; * 21.3 versions prior to 21.3R3-S3; * 21.4 versions prior to 21.4R3-S1. 2023-10-13 7.8 CVE-2023-44194MISC juniper -- junos An Improperly Implemented Security Check for Standard vulnerability in storm control of Juniper Networks Junos OS QFX5k devices allows packets to be punted to ARP queue causing a l2 loop resulting in a DDOS violations and DDOS syslog. This issue is triggered when Storm control is enabled and ICMPv6 packets are present on device. This issue affects Juniper Networks: Junos OS * All versions prior to 20.2R3-S6 on QFX5k; * 20.3 versions prior to 20.3R3-S5 on QFX5k; * 20.4 versions prior to 20.4R3-S5 on QFX5k; * 21.1 versions prior to 21.1R3-S4 on QFX5k; * 21.2 versions prior to 21.2R3-S3 on QFX5k; * 21.3 versions prior to 21.3R3-S2 on QFX5k; * 21.4 versions prior to 21.4R3 on QFX5k; * 22.1 versions prior to 22.1R3 on QFX5k; * 22.2 versions prior to 22.2R2 on QFX5k. 2023-10-13 7.5 CVE-2023-44181MISCMISC juniper -- junos An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks allows an attacker to cause a Denial of Service (DoS) to the device upon receiving and processing a specific malformed ISO VPN BGP UPDATE packet. Continued receipt of this packet will cause a sustained Denial of Service condition. This issue affects: * Juniper Networks Junos OS: * All versions prior to 20.4R3-S6; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S4; * 21.3 versions prior to 21.3R3-S3; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R2-S2, 22.1R3; * 22.2 versions prior to 22.2R2-S1, 22.2R3; * 22.3 versions prior to 22.3R1-S2, 22.3R2. Juniper Networks Junos OS Evolved: * All versions prior to 20.4R3-S6-EVO; * 21.1-EVO version 21.1R1-EVO and later versions prior to 21.2R3-S4-EVO; * 21.3-EVO versions prior to 21.3R3-S3-EVO; * 21.4-EVO versions prior to 21.4R3-S3-EVO; * 22.1-EVO versions prior to 22.1R3-EVO; * 22.2-EVO versions prior to 22.2R2-S1-EVO, 22.2R3-EVO; * 22.3-EVO versions prior to 22.3R1-S2-EVO, 22.3R2-EVO. 2023-10-13 7.5 CVE-2023-44185MISC juniper -- junos An Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service (DoS). On all Junos OS QFX5000 Series and EX4000 Series platforms, when a high number of VLANs are configured, a specific DHCP packet will cause PFE hogging which will lead to dropping of socket connections. This issue affects: Juniper Networks Junos OS on QFX5000 Series and EX4000 Series * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S1; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2. This issue does not affect Juniper Networks Junos OS versions prior to 21.1R1 2023-10-13 7.5 CVE-2023-44191MISC juniper -- junos An Improper Input Validation vulnerability in the Packet Forwarding Engine of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause memory leak, leading to Denial of Service (DoS). On all Junos OS QFX5000 Series platforms, when pseudo-VTEP (Virtual Tunnel End Point) is configured under EVPN-VXLAN scenario, and specific DHCP packets are transmitted, DMA memory leak is observed. Continuous receipt of these specific DHCP packets will cause memory leak to reach 99% and then cause the protocols to stop working and traffic is impacted, leading to Denial of Service (DoS) condition. A manual reboot of the system recovers from the memory leak. To confirm the memory leak, monitor for "sheaf:possible leak" and "vtep not found" messages in the logs. This issue affects: Juniper Networks Junos OS QFX5000 Series: * All versions prior to 20.4R3-S6; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S4; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R3-S2; * 22.2 versions prior to 22.2R2-S2, 22.2R3; * 22.3 versions prior to 22.3R2-S1, 22.3R3; * 22.4 versions prior to 22.4R1-S2, 22.4R2. 2023-10-13 7.5 CVE-2023-44192MISC juniper -- junos An Out-of-Bounds Write vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). On all Junos OS and Junos OS Evolved devices an rpd crash and restart can occur while processing BGP route updates received over an established BGP session. This specific issue is observed for BGP routes learned via a peer which is configured with a BGP import policy that has hundreds of terms matching IPv4 and/or IPv6 prefixes. This issue affects Juniper Networks Junos OS: * All versions prior to 20.4R3-S8; * 21.1 version 21.1R1 and later versions; * 21.2 versions prior to 21.2R3-S2; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R2-S1, 21.4R3-S5. This issue affects Juniper Networks Junos OS Evolved: * All versions prior to 20.4R3-S8-EVO; * 21.1-EVO version 21.1R1-EVO and later versions; * 21.2-EVO versions prior to 21.2R3-S2-EVO; * 21.3-EVO version 21.3R1-EVO and later versions; * 21.4-EVO versions prior to 21.4R2-S1-EVO, 21.4R3-S5-EVO. 2023-10-13 7.5 CVE-2023-44197MISC juniper -- junos An Improper Check for Unusual or Exceptional Conditions vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX Series and MX Series allows an unauthenticated network-based attacker to cause an integrity impact in connected networks. If the SIP ALG is configured and a device receives a specifically malformed SIP packet, the device prevents this packet from being forwarded, but any subsequently received retransmissions of the same packet are forwarded as if they were valid. This issue affects Juniper Networks Junos OS on SRX Series and MX Series: * 20.4 versions prior to 20.4R3-S5; * 21.1 versions prior to 21.1R3-S4; * 21.2 versions prior to 21.2R3-S4; * 21.3 versions prior to 21.3R3-S3; * 21.4 versions prior to 21.4R3-S2; * 22.1 versions prior to 22.1R2-S2, 22.1R3; * 22.2 versions prior to 22.2R2-S1, 22.2R3; * 22.3 versions prior to 22.3R1-S2, 22.3R2. This issue doesn't not affected releases prior to 20.4R1. 2023-10-13 7.5 CVE-2023-44198MISC juniper -- junos An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). On Junos MX Series platforms with Precision Time Protocol (PTP) configured, a prolonged routing protocol churn can lead to an FPC crash and restart. This issue affects Juniper Networks Junos OS on MX Series: * All versions prior to 20.4R3-S4; * 21.1 version 21.1R1 and later versions; * 21.2 versions prior to 21.2R3-S2; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3; * 22.1 versions prior to 22.1R3; * 22.2 versions prior to 22.2R1-S1, 22.2R2. 2023-10-13 7.5 CVE-2023-44199MISC linux -- kernel An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. 2023-10-15 9.8 CVE-2023-45871MISCMISC linux -- kernel extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for try_grab_page. 2023-10-16 9.1 CVE-2023-40791MISCMISCMISCMISC linux -- kernel The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent. 2023-10-16 7.8 CVE-2023-45898MISCMISCMISCMISCMISC linux -- kernel An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. 2023-10-14 7.5 CVE-2023-45862MISCMISC netis-systems -- n3m_firmware Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings. 2023-10-13 9.8 CVE-2023-45465MISC netis-systems -- n3m_firmware Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings. 2023-10-13 9.8 CVE-2023-45467MISC netis-systems -- n3m_firmware Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. 2023-10-13 7.5 CVE-2023-45463MISC netis-systems -- n3m_firmware Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. 2023-10-13 7.5 CVE-2023-45464MISC netis-systems -- n3m_firmware Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the pingWdogIp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. 2023-10-13 7.5 CVE-2023-45468MISC netis-systems -- n3mv2_firmware Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings. 2023-10-13 9.8 CVE-2023-45466MISC nextcloud -- nextcloud_server Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability. 2023-10-16 8.8 CVE-2023-45151MISCMISCMISC nextcloud -- nextcloud_server Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available. 2023-10-13 7.5 CVE-2023-39960MISCMISCMISC node-qpdf -- node-qpdf All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the input pdf file path. 2023-10-14 9.8 CVE-2023-26155MISCMISC oracle -- fusion_middleware Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). 2023-10-17 9.8 CVE-2023-22072MISC oracle -- fusion_middleware Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). 2023-10-17 9.8 CVE-2023-22069MISC oracle -- fusion_middleware Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). 2023-10-17 9.8 CVE-2023-22089MISC oracle -- fusion_middleware Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). 2023-10-17 8.1 CVE-2023-22101MISC oracle -- fusion_middleware Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). 2023-10-17 7.5 CVE-2023-22019MISC oracle -- fusion_middleware Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). 2023-10-17 7.5 CVE-2023-22086MISC oracle -- fusion_middleware Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). 2023-10-17 7.5 CVE-2023-22108MISC oracle -- hospitality_applications Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in takeover of Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). 2023-10-17 8.8 CVE-2023-22085MISC oracle -- hospitality_applications Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in takeover of Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). 2023-10-17 8.8 CVE-2023-22087MISC oracle -- mysql Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). 2023-10-17 8.3 CVE-2023-22102MISC oracle -- mysql Vulnerability in the MySQL Installer product of Oracle MySQL (component: Installer: General). Supported versions that are affected are Prior to 1.6.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Installer executes to compromise MySQL Installer. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Installer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Installer accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Installer. Note: This patch is used in MySQL Server bundled version 8.0.35 and 5.7.44. CVSS 3.1 Base Score 7.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H). 2023-10-17 7.9 CVE-2023-22094MISC oracle -- virtualization Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: Only applicable to 7.0.x platform. CVSS 3.1 Base Score 7.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H). 2023-10-17 7.9 CVE-2023-22100MISC oracle -- virtualization Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. Note: Only applicable to 7.0.x platform. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). 2023-10-17 7.3 CVE-2023-22098MISC oracle -- virtualization Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. Note: Only applicable to 7.0.x platform. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H). 2023-10-17 7.3 CVE-2023-22099MISC otrs -- otrs The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify_result() function is not used the certificated is trusted always and it cannot be ensured that the certificate satisfies all necessary security requirements. This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired certificates, or conduct other attacks that could be detected if the certificate is properly validated. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34. 2023-10-16 9.1 CVE-2023-5422MISC prestashop -- prestashop Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_customer`, `id_conf`, `id_product` and `token` parameters in `aftermailajax.php via the 'id_product' parameter in hooks DisplayRightColumnProduct and DisplayProductButtons. 2023-10-14 9.8 CVE-2023-30154MISC qdpm -- qdpm qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI. 2023-10-14 9.8 CVE-2023-45856MISCMISC qdpm -- qdpm qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. 2023-10-14 7.5 CVE-2023-45855MISCMISC qnap -- container_station An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following version: Container Station 2.6.7.44 and later 2023-10-13 7.2 CVE-2023-32976MISC qnap -- quts_hero A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTScloud c5.1.0.2498 and later 2023-10-13 7.5 CVE-2023-32974MISC qnap -- quts_hero A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later 2023-10-13 7.2 CVE-2023-32973MISC qnap -- video_station A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.0 ( 2023/07/27 ) and later 2023-10-13 8.8 CVE-2023-34975MISC qnap -- video_station A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.0 ( 2023/07/27 ) and later 2023-10-13 8.8 CVE-2023-34976MISC rockwell_automation -- factorytalk_linx FactoryTalk Linx, in the Rockwell Automation PanelView Plus, allows an unauthenticated threat actor to read data from memory via crafted malicious packets. Sending a size larger than the buffer size results in leakage of data from memory resulting in an information disclosure. If the size is large enough, it causes communications over the common industrial protocol to become unresponsive to any type of packet, resulting in a denial-of-service to FactoryTalk Linx over the common industrial protocol. 2023-10-13 9.1 CVE-2023-29464MISC selenium -- selenium NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0. 2023-10-15 7.5 CVE-2023-5590MISCMISC solarwinds -- access_rights_manager The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on SolarWinds ARM Server. 2023-10-19 8.8 CVE-2023-35182MISCMISC solarwinds -- access_rights_manager The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse a SolarWinds service resulting in a remote code execution. 2023-10-19 8.8 CVE-2023-35184MISCMISC solarwinds -- access_rights_manager The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges. 2023-10-19 8.8 CVE-2023-35185MISCMISC solarwinds -- access_rights_manager The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability allows an unauthenticated user to achieve the Remote Code Execution. 2023-10-19 8.8 CVE-2023-35187MISCMISC solarwinds -- access_rights_manager The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds ARM API. 2023-10-19 8 CVE-2023-35180MISCMISC solarwinds -- access_rights_manager The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution. 2023-10-19 8 CVE-2023-35186MISCMISC solarwinds -- access_rights_manager The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation. 2023-10-19 7.8 CVE-2023-35181MISC solarwinds -- access_rights_manager The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resources to Privilege Escalation. 2023-10-19 7.8 CVE-2023-35183MISCMISC sonicwall -- sonicos SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunnel. 2023-10-17 8.8 CVE-2023-41715MISC sonicwall -- sonicos SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function. 2023-10-17 7.5 CVE-2023-41713MISC sourcecodester -- library_system A vulnerability classified as critical has been found in SourceCodester Library System 1.0. This affects an unknown part of the file index.php. The manipulation of the argument category leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-242145 was assigned to this vulnerability. 2023-10-14 9.8 CVE-2023-5580MISCMISCMISC totolink -- cp300+_firmware TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg. 2023-10-16 9.8 CVE-2023-36952MISC totolink -- cp300+_firmware TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection. 2023-10-16 9.8 CVE-2023-36953MISC totolink -- cp300+_firmware TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection. 2023-10-16 9.8 CVE-2023-36954MISC totolink -- cp300+_firmware TOTOLINK CP300+ show system processes extensive | match "mgd|PID" | except last PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 92476 root 100 0 500M 89024K CPU3 3 57.5H 89.60% mgd confirm (document.cookie) leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-242170 is the identifier assigned to this vulnerability. 2023-10-15 6.1 CVE-2023-5585MISCMISC spring -- security WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version `0.9.1.RELEASE`. Users are advised to upgrade. There are no known workarounds for this vulnerability. 2023-10-16 5.3 CVE-2023-45669MISCMISCMISC urllib3 -- urllib3 urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive). 2023-10-15 6.1 CVE-2018-25091MISCMISCMISC user_registration_&_login_and_user_management_system -- user_registration_&_login_and_user_management_system Cross Site Scripting (XSS) vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to run arbitrary code via fname, lname, email, and contact fields of the user registration page. 2023-10-16 5.4 CVE-2023-40851MISC vrite -- vrite Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0. 2023-10-13 6.5 CVE-2023-5573MISCMISC wordpress -- wordpress Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins Social Feed | Custom Feed for Social Media Networks plugin

Read more »

Best Buy launches Black Friday Sale: Apple M3 MacBook Pros for $150-$200 off MSRP
Black Friday MacBook deals for 2023 are now live at Best Buy. Apple MacBook Pros with M3, M3 Pro, and M3 Max CPUs are in stock and on Black Friday sale for $150-$200 off MSRP. Their prices are among the lowest currently available for new M3 MacBook Pros. - 14" M3 MacBook Pro (8GB/512GB): $1449, $150 off MSRP - 14" M3 MacBook Pro (8GB/1TB): $1649, $150 off MSRP - 14" M3 Pro MacBook Pro (18GB/512GB): $1849, $150 off MSRP - 14" M3 Pro MacBook Pro (18GB/1TB): $2249, $150 off MSRP - 14" M3 Max MacBook Pro (36GB/1TB): $2999, $200 off MSRP - 16" M3 Pro MacBook Pro (18GB/512GB): $2299, $200 off MSRP - 16" M3 Pro MacBook Pro (36GB/512GB): $2699, $200 off MSRP Prices valid for online orders only. In-store prices may vary. Order online and choose free shipping or free local store pickup (if available). For the latest prices and sales, see our 14" MacBook Pro Price Tracker and 16" MacBook Pro Price Tracker, both updated daily. The post first appeared on MacPrices.net.

Read more »

Record low Black Friday 10th-gen Apple iPad Prices: Take $100 off MSRP, prices start at only $349
Amazon has Apple's 10th-generation WiFi iPads on sale for $100 off MSRP, starting at only $349, as part of their Black Friday Sale. Their discount applies to all models and all colors. With the discount, Amazon's prices are the lowest we've ever seen for these iPads: - 10" 10th-generation 64GB WiFi iPads: $349 $100 off MSRP - 10" 10th-generation 256GB WiFi iPads: $499 $100 off MSRP - 10" 10th-generation 64GB WiFi + Cellular iPads: $499 $100 off MSRP - 10" 10th-generation 256GB WiFi + Cellular iPads: $649 $100 off MSRP For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Best Buy launches Black Friday Sale: Apple MacBook Airs for $150-$250 off MSRP
Black Friday MacBook deals for 2023 are now live at Best Buy. Apple MacBook Airs with M2 CPUs are in stock and on Black Friday sale for $150-$250 off MSRP in Space Gray, Silver, Starlight, and Midnight colors. Their prices are among the lowest currently available for new M2 MacBook Airs. - 15" M2 MacBook Air (8GB RAM/256GB SSD): $1049 $250 off MSRP - 15" M2 MacBook Air (8GB RAM/512GB SSD): $1249 $250 off MSRP - 13" M2 MacBook Air (8GB RAM/256GB SSD): $949 $150 off MSRP - 13" M2 MacBook Air (8GB RAM/512GB SSD): $1249 $150 off MSRP For even more savings, you can get the M1-powered 13" MacBook Air for $250 off MSRP as well, only $749: - 13" M1 MacBook Air (8GB RAM/256GB SSD): $749.99 $250 off MSRP Prices valid for online orders only. In-store prices may vary. Order online and choose free shipping or free local store pickup (if available). For the latest sales & prices, see our 13" MacBook Air Price Tracker and our 15" MacBook Air Price Tracker. The post first appeared on MacPrices.net.

Read more »

Apple Watch Ultra 2 on early Black Friday sale for $60 off MSRP
Amazon is offering a $60 discount on Apple Watch Ultra 2 models as part of their early Black Friday sale. Their price is now $739 for all models. Shipping is free. For the latest prices & deals, keep an eye on our Apple Watch Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Black Friday Sale: Amazon has Apple AirPods Max headphones for $100 off MSRP
Amazon has Apple AirPods Max headphones in stock and on sale for $100 off MSRP as part of their Black Friday sale. The sale price is valid for all colors at the time of this post. Shipping is free: - AirPods Max: $449.99 $100 off MSRP Amazon's price is the lowest available anywhere for AirPods Max. See our AirPods Price Tracker for the latest prices and deals from Apple and its retailers. The post first appeared on MacPrices.net.

Read more »

Black Friday Sale: Amazon has Apple AirPods Max headphones for $100 off MSRP
Amazon has Apple AirPods Max headphones in stock and on sale for $100 off MSRP as part of their Black Friday sale. The sale price is valid for all colors at the time of this post. Shipping is free: - AirPods Max: $449.99 $100 off MSRP Amazon's price is the lowest available anywhere for AirPods Max. See our AirPods Price Tracker for the latest prices and deals from Apple and its retailers. The post first appeared on MacPrices.net.

Read more »

Track the very latest MacBook Air and MacBook Pro Black Friday sales using our exclusive Price Trackers
Our Apple award-winning MacBook Price Trackers are continually updated with the latest information on prices, bundles, and availability for 16", 14", and (recently-discontinued) 13" MacBook Pros along with 13" and 15" MacBook Airs from Apple's authorized online retailers. We include prices for new as well as Apple Certified Refurbished models, along with any open-box MacBooks that might be available. Current sales that just dropped range up to $240 off MSRP for new MacBook Pros with M3, M3 Pro, and M3 Max CPUs and up to $250 off M2-powered MacBook Airs: - 16" MacBook Pros - 14" MacBook Pros - 13" MacBook Pros - 15" MacBook Airs - 13" MacBook Airs The post first appeared on MacPrices.net.

Read more »

Verizon has Apple AirPods 2 (Lightning) on sale for $184, 26% off original MSRP
Verizon has second-generation Apple AirPods Pro (MagSafe case, Lightning port) on clearance sale for $184.99 on their online store as part of their early Holiday sale. Their price is 26% off Apple's original MSRP, and it's the lowest price we've seen for AirPods Pro. Verizon service is not required for purchase. Buy online and choose free shipping or free local store pickup (if available). Sale price for online orders only, in-store price may vary. For the latest prices and sales, see our Apple AirPods Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Details of Apple’s 2023 Black Friday shopping event, live starting November 24th
Apple's four day Black Friday/Cyber Monday 2022 Shopping Event will run from November 24, 2023 to November 27, 2023. Receive a free $100-$200 Apple Gift Card with the purchase of select Macs and $50-$100 with select iPads. Get a $25-$75 Apple Gift Card with select iPhone models as well as $25-$50 Apple Watch models. AirPods qualify for $25 to $75 Gift Cards, depending on the model. Apple Gift Cards are included with the following products: Macs: - 15" M2 MacBook Air: $200 - 13" M2 MacBook Air: $175 - 13" M1 MacBook Air: $150 - Mac mini: $100 iPhones: - iPhone 14: $75... The post first appeared on MacPrices.net.

Read more »

Xfinity Mobile launches Black Friday sale: Switch and take $500-$800 off most new iPhones
Xfinity Mobile has launched their Black Friday sale for 2023. Valid from today through December 5, 2023, switch to Xfinity Mobile (Mobile Virtual Network Operator..using Verizon's network) and save $500 instantly on any iPhone 15, 14, or 13 and up to $800 off with eligible trade-in. The total is applied to your account as credits over a 24 month service term. The fine print: "Offer Ends 12/5/23. Requires qualifying phone trade-in, and purchase and activation of a new eligible Apple, Samsung, Google, or Motorola phone (excludes iPhone 12 mini, iPhone SE models, Galaxy S21 FE, Galaxy A-Series, Galaxy Z Fold, Pixel 6a, Pixel 7a, moto g stylus 5G 2023, moto g stylus 5G 2022, moto g power 5G, moto g play and moto g 5G) while supplies last, a 24-month Xfinity Mobile Device Payment Plan Agreement ("Device Agreement"), and activation of new Xfinity Mobile line within 30 days of phone purchase date..." This deal is live today at Xfinity Mobile. For the latest prices & sales, keep an eye on our iPhone Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Expercom launches Black Friday sale with new M3 Pro and M3 Max MacBook Pros up to $200 off MSRP
Apple retailer Expercom has launched their early Black Friday sale with Apple's new M3 Pro and M3 Max MacBook Pros available for up to $200 off MSRP. Shipping is free. Here is a rundown of their sale prices: - 14" M3 MacBook Pro (8GB/512GB): $1519.05, $80 off MSRP - 14" M3 MacBook Pro (8GB/1TB): $1709.05, $90 off MSRP - 14" M3 Pro MacBook Pro (18GB/512GB): $1899.05, $100 off MSRP - 14" M3 Pro MacBook Pro (18GB/1TB): $2279.05, $120 off MSRP - 14" M3 Max MacBook Pro (36GB/1TB): $3039.05, $160 off MSRP - 16" M3 Pro MacBook Pro (18GB/512GB): $2374.05, $125 off MSRP - 16" M3 Pro MacBook Pro (36GB/512GB): $2754.05, $145 off MSRP - 16" M3 Max MacBook Pro (36GB/1TB): $3324.05, $175 off MSRP - 16" M3 Max MacBook Pro (48GB/1TB): $3799.05, $200 off MSRP Discounts are also available on various custom options such as extra RAM and storage space. The post first appeared on MacPrices.net.

Read more »

Black Friday Sale: 9th-generation Apple iPads for $80-$90 off MSRP, prices start at only $249
Amazon has Apple's 9th generation 10.2" iPads on sale for $80-$90 off MSRP, with prices available starting at $249, as part of their early Black Friday sale. Their prices are the lowest new prices available for iPads anywhere: - 10" 64GB WiFi iPad (Space Gray or Silver): $249 $80 off MSRP - 10" 256GB WiFi iPad (Space Gray or Silver): $399 $80 off MSRP - 10" 64GB WiFi + Cell iPad (Space Gray or Silver): $399 $80 off MSRP - 10" 256GB WiFi + Cell iPad (Silver): $519.99 $90 off MSRP - 10" 256GB WiFi + Cell iPad (Space Gray): $529 $80 off MSRP Amazon's prices are dynamic and can fluctuate several times per hour. These are the lowest prices of the day, so check their site (or your shopping cart) regularly. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »