Updated python-django package fixes a security vulnerability

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words method with html=True and the truncatewordshtml template filter are subject to a potential regular expression denial-of-service attack via a crafted string. CVE-2024-27351...

New Phishing Attack Uses Clever Microsoft Office Trick to Deploy NetSupport RAT

A new phishing campaign is targeting U.S. organizations with the intent to deploy a remote access trojan called NetSupport RAT. Israeli cybersecurity company Perception Point is tracking the activity under the moniker Operation PhantomBlu. "The PhantomBlu operation introduces a nuanced exploitati...

Incorrect Default Permissions

Liferay Portal is vulnerable to Incorrect Default Permissions. This vulnerability is due to insufficient access control mechanisms for guest users. The guest users can view any web content template by default. An attackers can exploit this to view any template via the UI or API...

CVE-2024-24230

Komm.One CMS 10.4.2.14 has a Server-Side Template Injection SSTI vulnerability via the Velocity template engine. It allows remote attackers to execute arbitrary code via a URL that specifies java.lang.Runtime in conjunction with getRuntime.exec followed by an OS command...

CVE-2024-24230

Komm.One CMS 10.4.2.14 is affected by a Server-Side Template Injection (SSTI) in the Velocity engine. The underling issue allows an attacker to craft a URL that uses java.lang.Runtime and getRuntime().exec to execute arbitrary OS commands on the server. This CVE-2024-24230 entry is corroborated b...

CVE-2024-24230

Komm.One CMS 10.4.2.14 has a Server-Side Template Injection SSTI vulnerability via the Velocity template engine. It allows remote attackers to execute arbitrary code via a URL that specifies java.lang.Runtime in conjunction with getRuntime.exec followed by an OS command...

Winter CMS 1.2.3 - Server-Side Template Injection (SSTI) (Authenticated) Vulnerability

Exploit Title: Winter CMS 1.2.2 - Server-Side Template Injection SSTI Authenticated Exploit Author: tmrswrr Vendor: https://wintercms.com/ Software Link: https://github.com/wintercms/winter/releases/v1.2.2 Vulnerable Versions: 1.2.2 Tested : https://www.softaculous.com/demos/WinterCMS 1 Login wit...

Exploit for Path Traversal in Zimbra Collaboration

CVE-2022-41352 PoC How does this detection method work?...

Exploit for Improper Input Validation in Adobe Commerce

CVE-2022-24682 PoC How does this detection method work?...

PT-2024-18366 · WordPress · The Ultimate Gift Cards For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates plugin for WordPress versions up to, and including, 2.6.6 Description: The issue allows unauthenticated attackers to read...

Winter CMS 1.2.3 - Server-Side Template Injection (SSTI) (Authenticated)

Exploit Title: Winter CMS 1.2.2 - Server-Side Template Injection SSTI Authenticated Exploit Author: tmrswrr Date: 12/05/2023 Vendor: https://wintercms.com/ Software Link: https://github.com/wintercms/winter/releases/v1.2.2 Vulnerable Versions: 1.2.2 Tested :...

CVE-2021-47129

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: skip expectations for confirmed conntrack nftctexpectobjeval calls nfctextadd for a confirmed conntrack entry. However, nfctextadd can only be called for !nfctisconfirmed. 1825.349056 WARNING: CPU: 0 PID: 1279 a...

CVE-2021-47129 netfilter: nft_ct: skip expectations for confirmed conntrack

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: skip expectations for confirmed conntrack nftctexpectobjeval calls nfctextadd for a confirmed conntrack entry. However, nfctextadd can only be called for !nfctisconfirmed. 1825.349056 WARNING: CPU: 0 PID: 1279 a...

GHSA-W5WX-6G2R-R78Q Nuclei allows unsigned code template execution through workflows

Overview A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing custom workflows, potentially allowing the execution of malicious code on the user's system. This...

CVE-2024-25919

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6...

CVE-2024-25919

CVE-2024-25919 affects the WordPress plugin Custom Field Template (versions up to and including 2.6). The issue is a Stored XSS flaw in the $search_label handling, resulting from improper input sanitization/output escaping. Exploitation could allow an authenticated attacker (Contributor level) to...

CVE-2024-25919 WordPress Custom Field Template plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6...

CVE-2024-25919 WordPress Custom Field Template plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6...

CVE-2024-27351

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words method with html=True and the truncatewordshtml template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because ...

WordPress Plugin Custom Field Template Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...