CVE-2022-3248

creationtimestamp| type| source ---|---|--- 2023-10-05 18:12:43+00:00| seen| https://t.me/cibsecurity/71666...

CVE-2022-3248

OpenShift API admission checks do not enforce the “custom-host” permissions, allowing boundary violations since permissions are not applied. This CVE is described in multiple sources (NVD, Red Hat, OSV, CVE List, PRION, etc.) with no explicit affected versions or published patch details in the su...

SUSE SLED15: gstreamer-plugins-good / gstreamer-plugins-good-32bit / etc (SUSE-SU-2023:3248-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3248-1 advisory. - CVE-2023-37327: Fixed FLAC file parsing integer overflow remote code execution vulnerability. bsc121312...

CVE-2023-3248 All-in-one Floating Contact Form < 2.1.2 - Admin+ Stored Cross-Site Scripting

The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2023-3248 All-in-one Floating Contact Form < 2.1.2 - Admin+ Stored Cross-Site Scripting

The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2023-3248

The CVE-2023-3248 entry concerns the All-in-one Floating Contact Form WordPress plugin prior to version 2.1.2, which does not adequately sanitise and escape certain settings. The vulnerability enables Stored Cross-Site Scripting (XSS) by an admin or other high-privileged user, even when unfiltere...

WordPress All-in-one Floating Contact Form – My Sticky Elements Plugin < 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software All-in-one Floating Contact Form – My Sticky Elements Type Plugin Vulnerable versions 2.1.2 Fixed in 2.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3248 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID...

RHEL 9 : git (RHSA-2023:3248)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3248 advisory. Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a...

SUSE CVE-2015-3248

openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not properly setup, to fill the filesystem hosting /var/lib and cause a denial of service disk consumption...

SUSE: Security Advisory (SUSE-SU-2016:3248-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-3248

Cisco UCS Director and Cisco UCS Director Express for Big Data expose multiple REST API vulnerabilities (CVE-2020-3248 and related CVEs) that may allow a remote attacker to bypass authentication or perform directory traversal. Root cause: insufficient validation of user input in REST API paths (e...

Oracle WebLogic 12.1.2.0 RMI Registry UnicastRef Object Java Deserialization Remote Code Execution

Exploit for multiple platform in category web applications !/usr/bin/python -- coding: utf-8 -- from argparse import RawTextHelpFormatter import socket, argparse, subprocess, ssl, os.path HELPMESSAGE = ''' --------------------------------------------------------------------------------------...

Oracle WebLogic 12.1.2.0 Remote Code Execution

!/usr/bin/python -- coding: utf-8 -- from argparse import RawTextHelpFormatter import socket, argparse, subprocess, ssl, os.path HELPMESSAGE = ''' -------------------------------------------------------------------------------------- Developped by bobsecq: [email protected]...

Exploit for CVE-2017-3248

exploits/weblogic/exploit-CVE-2017-3248-bobsecq.py The script...

Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution

Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution !/usr/bin/python -- coding: utf-8 -- from argparse import RawTextHelpFormatter import socket, argparse, subprocess, ssl, os.path HELPMESSAGE = '''...

Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution

!/usr/bin/python -- coding: utf-8 -- from argparse import RawTextHelpFormatter import socket, argparse, subprocess, ssl, os.path HELPMESSAGE = ''' -------------------------------------------------------------------------------------- Developped by bobsecq: [email protected]...

CVE-2017-3248

creationtimestamp| type| source ---|---|--- 2018-01-05 01:08:44+00:00| seen| MISP/5a4ecbf4-1b24-4a5f-9f4d-4b7c98036464 2018-09-19 17:28:51+00:00| seen| MISP/5ba281fe-cc88-4bf3-a9ef-3c290a021402 2019-04-01 23:24:03+00:00| seen|...

RHEL 7 : .NET Core (RHSA-2017:3248)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3248 advisory. New versions of .NET Core that address several security vulnerabilities are now available. The updated versions are .NET Core 1.0.8, 1.1.5 a...

CVE-2015-3248

CVE-2015-3248 concerns OpenHPI prior to 3.6.0, where the file openhpi/Makefile.am creates world-writable permissions on the /var/lib/openhpi directory. This enables local users, under improper quota configurations, to exhaust the filesystem hosting /var/lib and trigger a denial of service (disk c...

Ubuntu 14.04 LTS : Puppet vulnerabilities (USN-3308-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3308-1 advisory. Dennis Rowe discovered that Puppet incorrectly handled the search path. A local attacker could use this issue to possibly execute arbitrary code...