Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Krebs on Security

Palo Alto Unit 42

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.

CVE-2023-49098 is a security vulnerability identified in the discourse-reactions plugin, which is an extension for the Discourse forum platform that enables users to add reactions to posts. The vulnerability is classified under CWE-284, indicating improper access control. Specifically, the flaw allows unauthorized access to data related to a user's reaction notifications. This means that an attacker with some level of privileges could potentially view reaction notification data that should be restricted, leading to limited information disclosure. The vulnerability affects versions of the discourse-reactions plugin prior to the commit 2c26939, where the issue was patched. The CVSS v3.1 base score is 3.5, reflecting a low severity level. The vector indicates that the attack can be performed remotely (AV:N) with low attack complexity (AC:L), but requires privileges (PR:L) and user interaction (UI:R). The impact is limited to confidentiality (C:L) with no effect on integrity or availability. No known exploits are currently in the wild. The vulnerability does not allow full compromise of the system but could leak some user-specific notification data related to reactions, which might be sensitive in certain contexts. The patch is available but no direct links were provided in the source information.

Detailed information about CVE-2023-49098: CWE-284: Improper Access Control in discourse discourse-reactions affecting discourse discourse-reactions. Get real-t

CVE-2023-49098: CWE-284: Improper Access Control in discourse discourse-reactions - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-49098: CWE-284: Improper Access Control in discourse discourse-reactions

Threats Tagged 'cve-2023-49098'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2023-49098'

Lead Pen Test Professional