Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-26 02:58Z
2023-06-28
2023-06-28 15:15Z
HIGH

CVE-2023-20006 — Cisco Secure_firewall_threat_defense: A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-20006

A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to an implementation error within the cryptographic functions for SSL/TLS traffic p CVSSv3.1 8.6 (HIGH) · EPSS 57th percentile

CWECWE 681VNDCiscoTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2023-06-28
2023-06-28 15:15Z
CRIT

CVE-2022-44276 — Tecrail Responsive_filemanager: In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-44276

In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE. CVSSv3.1 9.8 (CRITICAL) · EPSS 83th percentile

CWECWE 434VNDResponsiveVNDTecrailTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2023-06-27
2023-06-27 00:00Z
HIGH

NAPLISTENER: more bad dreams from developers of SIESTAGRAPH

Elastic Security Labs·elastic.co

Elastic Security Labs identified NAPLISTENER, a C# HTTP listener malware deployed by REF2924 (SIESTAGRAPH developers) as a persistence mechanism. The malware masquerades as legitimate Windows services, filters web traffic to evade detection, and executes base64-decoded .NET assemblies in memory via a hidden HTTP endpoint (/ews/MsExgHealthCheckd/). The threat represents a shift from data theft to establishing persistent remote access in southern and southeastern Asian targets.

SRFOsTACTA0005SRFNetworkTACTA0003OSWindowsTYPResearchTYPThreat IntelSTGDefense Evasion
78
Edit Score
2023-06-25
2023-06-25 22:15Z
CRIT

CVE-2023-36660 — Nettle_project Nettle: The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-36660

The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption. CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile

CWECWE 787VNDNettle ProjectVNDOcbTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-06-24
2023-06-24 03:15Z
HIGH

CVE-2023-3388 — Beautiful-cookie-banner Beautiful_cookie_consent_banner: The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3388

The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2. CVSSv3.1 7.2 (HIGH) · EPSS 99th percentile

CWECWE 79VNDBeautiful Cookie BannerVNDBeautifulTYPVulnerability
7.2
CVSS v3.1
100
Edit Score
2023-06-24
2023-06-24 03:15Z
CRIT

CVE-2023-3197 — Inspireui Mstore_api: The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3197

The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile

CWECWE 89VNDInspireuiVNDMstoreTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2023-06-23
2023-06-23 19:15Z
HIGH

CVE-2023-34672 — Elenos Etg150_firmware: Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-34672

Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role within the admin profile. An attack could occur over the public Internet in some cases. CVSSv3.1 8.8 (HIGH) · EPSS 51th percentile

CWECWE 281VNDAccessVNDElenosTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2023-06-23
2023-06-23 18:15Z
HIGH

CVE-2023-34671 — Elenos Etg150_fm_firmware: Improper Access Control leads to privilege escalation affecting Elenos ETG150 FM transmitter running on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-34671

Improper Access Control leads to privilege escalation affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role in the user profile. An attack could occur over the public Internet in some cases. CVSSv3.1 8.8 (HIGH) · EPSS 55th percentile

VNDAccessVNDElenosTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-22
2023-06-22 02:15Z
HIGH

CVE-2019-25152 — Tychesoftwares Abandoned_cart_lite_for_woocommerce: The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25152

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard. CVSSv3.1 7.2 (HIGH) · EPSS 96th percentile

CWECWE 79VNDTychesoftwaresVNDAbandonedTYPVulnerability
7.2
CVSS v3.1
94
Edit Score
2023-06-21
2023-06-21 13:15Z
HIGH

CVE-2022-45287 — Temenos Cwx: An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-45287

An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges and perform arbitrary Administrative commands. CVSSv3.1 8.8 (HIGH) · EPSS 64th percentile

VNDRegistrationVNDTemenosTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-21
2023-06-21 00:00Z
HIGH

Initial research exposing JOKERSPY

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs disclosed JOKERSPY (REF9134), an active intrusion campaign targeting a Japanese cryptocurrency exchange using custom macOS backdoors. The attack chain involves xcc (a Swift-based TCC permission checker), sh.py (a Python backdoor), and Swiftbelt enumeration tool, with initial access likely via compromised developer tools or malicious dependencies. The threat actor demonstrates sophisticated macOS-specific evasion techniques including TCC database manipulation and self-signed binary execution.

SRFApplicationSRFOsTACTA0004TACTA0005TACTA0001TACTA0007TACTA0003OSMacos
78
Edit Score
2023-06-20
2023-06-20 05:15Z
HIGH

CVE-2023-3325 — Cmscommander Cms_commander: The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3325

The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to, and including, 2.287. This makes it possible for unauthenticated attackers to the plugin to change the '_cmsc_public_key' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escala CVSSv3.1 8.1 (HIGH) · EPSS 30th percentile

CWECWE 345CWECWE 331VNDCmscommanderVNDCmsTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2023-06-19
2023-06-19 13:15Z
CRIT

CVE-2023-2907 — Marksoft Marksoft: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-2907

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marksoft allows SQL Injection.This issue affects Marksoft: through Mobile:v.7.1.7 ; Login:1.4 ; API:20230605. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 89VNDMarksoftTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-06-19
2023-06-19 11:15Z
CRIT

CVE-2023-34416 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-34416

Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12. CVSSv3.1 9.8 (CRITICAL) · EPSS 60th percentile

CWECWE 787VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-06-19
2023-06-19 11:15Z
CRIT

CVE-2023-29542 — Mozilla Firefox: A newline in a filename could have been used to bypass the file extension

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-29542

A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. CVSSv3.1 9.8 (CRITICAL) · EPSS 60th percentile

VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-06-19
2023-06-19 11:15Z
CRIT

CVE-2023-29534 — Mozilla Firefox_focus: Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-29534

Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and spoofing attacks. *This bug only affects Firefox and Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112. CVSSv3.1 9.1 (CRITICAL) · EPSS 50th percentile

VNDMozillaVNDDifferentTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2023-06-19
2023-06-19 10:15Z
CRIT

CVE-2023-29531 — Mozilla Firefox: An attacker could have caused an out of bounds memory access using WebGL APIs

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-29531

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. *This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. CVSSv3.1 9.8 (CRITICAL) · EPSS 61th percentile

CWECWE 787VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-06-16
2023-06-16 18:15Z
CRIT

CVE-2023-34832 — Tp-link Archer_ax10_firmware: Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-34832

TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4. CVSSv3.1 9.8 (CRITICAL) · EPSS 74th percentile

CWECWE 120VNDTp LinkVNDLinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-06-14
2023-06-14 14:15Z
CRIT

CVE-2023-34752 — Bloofox Bloofoxcms: v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-34752

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit. CVSSv3.1 9.8 (CRITICAL) · EPSS 92th percentile

CWECWE 89VNDBloofoxTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2023-06-13
2023-06-13 21:15Z
CRIT

CVE-2023-34944 — Chamilo Chamilo_lms: An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-34944

An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file. CVSSv3.1 9.8 (CRITICAL) · EPSS 61th percentile

CWECWE 434VNDChamiloTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-06-13
2023-06-13 17:15Z
CRIT

CVE-2023-31541 — Ckeditor Ckeditor: A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-31541

A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server. CVSSv3.1 9.8 (CRITICAL) · EPSS 75th percentile

CWECWE 434VNDCkeditorTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2023-06-13
2023-06-13 15:15Z
CRIT

CVE-2023-35064 — Satos Satos_mobile: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-35064

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Satos Satos Mobile allows SQL Injection through SOAP Parameter Tampering.This issue affects Satos Mobile: before 20230607. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 89VNDSatosTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-06-13
2023-06-13 12:15Z
CRIT

CVE-2023-3050 — Tmtmakine Lockcell_firmware: Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3050

Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass.This issue affects Lockcell: before 15. CVSSv3.1 9.8 (CRITICAL)

CWECWE 565CWECWE 784VNDTmtmakineVNDRelianceTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-06-13
2023-06-13 12:15Z
CRIT

CVE-2023-3049 — Tmtmakine Lockcell_firmware: Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3049

Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This issue affects Lockcell: before 15. CVSSv3.1 9.8 (CRITICAL) · EPSS 81th percentile

CWECWE 434VNDTmtmakineTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-06-13
2023-06-13 12:15Z
CRIT

CVE-2023-3048 — Tmtmakine Lockcell_firmware: Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass.This

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3048

Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass.This issue affects Lockcell: before 15. CVSSv3.1 9.8 (CRITICAL)

CWECWE 639VNDTmtmakineTYPVulnerability
9.8
CVSS v3.1
99
Edit Score