Security
Headlines
HeadlinesLatestCVEs

Tag

#git

CVE-2023-45542: GitHub - ahrixia/CVE-2023-45542: mooSocial v3.1.8 is vulnerable to cross-site scripting on search function.

Cross Site Scripting vulnerability in mooSocial 3.1.8 allows a remote attacker to obtain sensitive information via a crafted script to the q parameter in the Search function.

CVE
#xss#vulnerability#web#windows#apple#git#chrome#webkit
CVE-2023-42459: [19416] Fix bad-free when receiving malformed DATA submessage by MiguelCompany · Pull Request #3824 · eProsima/Fast-DDS

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

ROMCOMLITE: Stealthier Version of ROMCOM Backdoor Targets Female Politicians

By Deeba Ahmed Watch out, ladies! This is a post from HackRead.com Read the original post: ROMCOMLITE: Stealthier Version of ROMCOM Backdoor Targets Female Politicians

CVE-2023-45660: fix: Check strict cookies for image proxy by ChristophWurst · Pull Request #8459 · nextcloud/mail

Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.

CVE-2023-45683: Merge pull request from GHSA-267v-3v32-g6q5 · crewjam/saml@b07b16c

github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the victim’s browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: SP registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or publicly accessible to ease the IdP interoperability. This issue is fixed in version 0.4.14. Users unable to upgrade may perform external validation of URLs provided in SAML metadata, or restrict the ability for end-users to upload arbitrary metadata.

How Is Machine Learning Used in Fraud Detection?

By Owais Sultan Machine learning is transforming fraud detection by swiftly identifying unusual patterns in data, helping prevent financial losses and… This is a post from HackRead.com Read the original post: How Is Machine Learning Used in Fraud Detection?

CVE-2023-45985: bug_submit/TOTOLINK/setParentalRules.md at main · Archerber/bug_submit

TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 were discovered to contain a stack overflow in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

CVE-2023-45984: bug_submit/TOTOLINK/setLanguageCfg.md at main · Archerber/bug_submit

TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg.

12 Best AI-powered Customer Communication Platforms for Contact Centers

By Owais Sultan AI-powered Customer Communication Platforms will revolutionize customer interactions, streamlining support, and providing personalized, efficient service, ultimately enhancing customer… This is a post from HackRead.com Read the original post: 12 Best AI-powered Customer Communication Platforms for Contact Centers