CVE-2024-3848

CVE-2024-3848 affects mlflow/mlflow up to version 2.11.0. The path traversal stems from improper handling of the fragment component in artifact URLs, where a ‘#’ can insert a path into the URL fragment and bypass validation, allowing an attacker to read arbitrary files by mapping the URL to a fil...

mooDating 1.2 - Reflected Cross-site scripting Vulnerability

Exploit Title: mooDating 1.2 - Reflected Cross-site scripting XSS Exploit Author: CraCkEr aka skalvin Vendor: mooSocial Vendor Homepage: https://moodatingscript.com/ Software Link: https://demo.moodatingscript.com/home Version: 1.2 Tested on: Windows 10 Pro Impact: Manipulate the content of the...

mooDating 1.2 Cross Site Scripting

Exploit Title: mooDating 1.2 - Reflected XSS Exploit Author: CraCkEr aka skalvin Date: 22/07/2023 Vendor: mooSocial Vendor Homepage: https://moodatingscript.com/ Software Link: https://demo.moodatingscript.com/home Tested on: Windows 10 Pro Impact: Manipulate the content of the site CVE:...

CVE-2023-3848

The CVE-2023-3848 issue affects mooSocial mooDating v1.2, specifically the URL Handler’s /users/view processing. The vulnerability is a cross-site scripting (XSS) flaw triggered via URL parameters, potentially exploitable remotely. Root cause: improper handling/ sanitization of data in the /users...

SUSE CVE-2007-3848

Linux kernel 2.4.35 and other versions allows local users to send arbitrary signals to a child process that is running at higher privileges by causing a setuid-root parent process to die, which delivers an attacker-controlled parent process death signal PRSETPDEATHSIG...

SUSE CVE-2011-3848

Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request CSR to arbitrary locations via 1 a double-encoded key parameter in the URI in 2.7.x, 2 the CN in the Subject of a CSR in 2.6 and 0.25...

CVE-2022-3848

creationtimestamp| type| source ---|---|--- 2022-11-28 16:28:01+00:00| seen| https://t.me/cibsecurity/53566...

CVE-2022-3848

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin...

CVE-2022-3848

CVE-2022-3848 affects the WordPress plugin WP User Merger prior to version 1.5.3. The root cause is insufficient sanitisation/escaping of a parameter before its use in an SQL statement, enabling SQL injection with low-privilege admin-level access. The documented remediation is to update to versio...

CVE-2022-3848 WP User Merger < 1.5.3 - Admin+ SQLi via wpsu_user_id

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin...

CVE-2022-3848 WP User Merger < 1.5.3 - Admin+ SQLi via wpsu_user_id

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin...

Ubuntu: Security Advisory (USN-1093-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2019-0133)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-3848

creationtimestamp| type| source ---|---|--- 2021-10-06 14:31:47+00:00| seen| https://t.me/cibsecurity/30026...

CVE-2021-3848

An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1, and Worry-Free Business Security Services could allow a local attacker to create an arbitrary file with higher privileges that could lead to a...

CVE-2021-3848

CVE-2021-3848 affects Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1, and Worry-Free Business Security Services. The vulnerability is a local privilege escalation that allows an attacker who can execute low-privileged code to create an arbitrary file with highe...

GLSA-202101-24 : cfitsio: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202101-24 cfitsio: Multiple vulnerabilities Multiple vulnerabilities have been discovered in cfitsio. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for detail...

RHEL 7 : libmspack (RHSA-2020:3848)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3848 advisory. The libmspack packages contain a library providing compression and extraction of the Cabinet CAB file format used by Microsoft. Security Fixes:...

About the security content of macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...

CVE-2020-3848

CVE-2020-3848 affects macOS Catalina CoreBluetooth. It is described as a memory corruption issue resolved by improved input validation and fixed in macOS Catalina 10.15.3. Impact: remote attacker could cause an application termination or arbitrary code execution. Remediation: apply the macOS Cata...