8507 matches found
CVE-2023-32235
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js...
Ghost 路径遍历漏洞
Ghost is an open source content management system . Ghost suffers from a directory traversal vulnerability that stems from a lack of validity checking of paths in frontend/web/middleware/static-theme.js when processing directory requests, which can be exploited by an attacker to read arbitrary...
CXF: directory listing / code exfiltration
A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to ...
hsqldb: Untrusted input may lead to RCE attack
A flaw was found in the HSQLDB package. This flaw allows untrusted inputs to execute remote code due to any static method of any Java class in the classpath, resulting in code execution by default...
PT-2023-9398 · Yealink · Yealink Meeting Server
Name of the Vulnerable Software and Affected Versions: Yealink Meeting Server versions prior to V26.0.0.67 Description: The issue is related to insufficient protection of service data, allowing a remote attacker to gain access to user authentication data. Specifically, attackers can obtain static...
Malicious code in ladoputi-static (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1448356c200aec8d8b1197163159b7b15288c3629fc0a3ec2d33dd82c06725ac The OpenSSF Package Analysis project identified 'ladoputi-static' @ 99.99.99 npm as malicious. It is considered malicious because: - The package...
MAL-2023-1223 Malicious code in ladoputi-static (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1448356c200aec8d8b1197163159b7b15288c3629fc0a3ec2d33dd82c06725ac The OpenSSF Package Analysis project identified 'ladoputi-static' @ 99.99.99 npm as malicious. It is considered malicious because: - The package...
Bearer - Code Security Scanning Tool (SAST) That Discover, Filter And Prioritize Security Risks And Vulnerabilities Leading To Sensitive Data Exposures (PII, PHI, PD)
Discover, filter, and prioritize security risks and vulnerabilities impacting your code. Bearer is a static application security testing SAST tool that scans your source code and analyzes your data flows to discover, filter and prioritize security risks and vulnerabilities leading to sensitive da...
Pimcore 跨站脚本漏洞
Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A cross-site scripting vulnerability exists in...
CVE-2023-2291
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus AMP build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a...
CVE-2023-2291
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus AMP build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a...
Cross site scripting
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus AMP build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a...
PortEx - Java Library To Analyse Portable Executable Files With A Special Focus On Malware Analysis And PE Malformation Robustness
PortEx is a Java library for static malware analysis of Portable Executable files. Its focus is on PE malformation robustness, and anomaly detection. PortEx is written in Java and Scala, and targeted at Java applications. Features Reading header information from: MSDOS Header, COFF File Header,...
CVE-2023-2291
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus AMP build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a...
PT-2023-18769 · Manageengine · Zoho Manageengine Access Manager Plus +2
Name of the Vulnerable Software and Affected Versions: ManageEngine Access Manager Plus AMP build 4309 ManageEngine Password Manager Pro affected versions not specified ManageEngine PAM360 affected versions not specified Description: Static credentials exist in the PostgreSQL data used in the...
CVE-2023-2291
CVE-2023-2291 affects ManageEngine products: Access Manager Plus (AMP) in build 4309, Password Manager Pro, and PAM360. The root cause is static credentials stored in PostgreSQL data, which could allow a low-privilege user to modify configuration data and escalate to Administrative privileges. Th...
多款ZOHO产品安全漏洞
ZOHO ManageEngine Password Manager Pro and so on are products of ZOHO USA.ZOHO ManageEngine Password Manager Pro is a password manager.ZOHO ManageEngine Access Manager Plus is a password manager. ZOHO ManageEngine PAM360 is a complete PAM software. A security vulnerability exists in ManageEngine...
Striker - A Command And Control (C2)
Striker is a simple Command and Control C2 program. Disclaimer This project is under active development. Most of the features are experimental, with more to come. Expect breaking changes. Features A Agents Native agents for linux and windows hosts. Self-contained, minimal python agent should you...
[SECURITY] Fedora 38 Update: dnsmasq-2.89-2.fc38
Dnsmasq is lightweight, easy to configure DNS forwarder and DHCP server. It is designed to provide DNS and, optionally, DHCP, to a small network. It can serve the names of local machines which are not in the global DNS. The DHCP server integrates with the DNS server and allows machines with...