EulerOS Virtualization 2.11.1 : c-ares (EulerOS-SA-2023-3049)

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will...

CVE-2024-20709

creationtimestamp| type| source ---|---|--- 2024-01-11 22:22:05+00:00| seen| https://t.me/ctinow/166872 2024-01-15 14:26:55+00:00| seen| https://t.me/ctinow/168369 2024-02-03 12:46:30+00:00| seen| https://t.me/ctinow/178538...

CVE-2023-6883

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

Design/Logic Flaw

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVE-2023-6883 Easy Social Feed <= 6.5.2 - Missing Authorization to Settings Modification

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVE-2023-6883 Easy Social Feed <= 6.5.2 - Missing Authorization to Settings Modification

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

PT-2024-15118

Name of the Vulnerable Software and Affected Versions Easy Social Feed plugin for WordPress versions up to, and including, 6.5.2 Description The issue allows authenticated attackers with subscriber-level access and above to perform unauthorized actions due to a missing capability check on multipl...

PT-2024-15186 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress versions up to, and including, 5.9.2 Description: The issue is related to Stored Cross-Site Scripting via custom ID due t...

GitLab 14.1 < 14.1.2 (CVE-2021-22236)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1...

Easy Social Feed < 6.5.3 - Subscriber+ Settings Update

Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin's...

CVE-2024-0195

creationtimestamp| type| source ---|---|--- 2024-01-02 22:26:52+00:00| seen| https://t.me/ctinow/162056 2024-01-03 01:37:23+00:00| seen| https://t.me/cibsecurity/74202 2024-01-09 08:16:07+00:00| seen| https://t.me/ctinow/164842 2024-01-10 09:39:51+00:00| published-proof-of-concept|...

CVE-2023-51469

creationtimestamp| type| source ---|---|--- 2023-12-31 19:26:48+00:00| seen| https://t.me/ctinow/161158 2024-01-01 01:32:53+00:00| seen| https://t.me/cibsecurity/74078 2024-01-22 11:12:07+00:00| seen| https://t.me/ctinow/171091...

CVE-2023-7178

creationtimestamp| type| source ---|---|--- 2023-12-30 18:26:17+00:00| seen| https://t.me/ctinow/160942 2023-12-31 01:32:39+00:00| seen| https://t.me/cibsecurity/74039 2024-01-05 22:16:32+00:00| seen| https://t.me/ctinow/163730 2024-01-21 19:51:48+00:00| seen| https://t.me/ctinow/170911...

Friday Squid Blogging: Sqids

Theyre short unique strings: Sqids pronounced "squids" is an open-source library that lets you generate YouTube-looking IDs from numbers. These IDs are short, can be generated from a custom alphabet and are guaranteed to be collision-free. I havent dug into the details enough to know how they can...

CVE-2023-31293

creationtimestamp| type| source ---|---|--- 2023-12-29 04:26:32+00:00| seen| https://t.me/ctinow/160314 2023-12-30 01:32:38+00:00| seen| https://t.me/cibsecurity/73876 2024-01-20 15:17:09+00:00| seen| https://t.me/ctinow/170646...

CVE-2023-50841

creationtimestamp| type| source ---|---|--- 2023-12-28 20:26:46+00:00| seen| https://t.me/ctinow/160171 2024-01-20 15:17:05+00:00| seen| https://t.me/ctinow/170642...

CVE-2023-50928: Improper Access Control

"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event...

RHSA-2023:7885

creationtimestamp| type| source ---|---|--- 2023-12-20 11:18:01+00:00| seen| https://t.me/ctinow/156879...

CVE-2023-50769

Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Design/Logic Flaw

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious backend entity that also has the...