CentOS 7 : kernel-rt (RHSA-2023:4821)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4821 advisory. - An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information...

CentOS 7 : kernel-rt (RHSA-2023:0400)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0400 advisory. - hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 CVE-2021-26401 - A flaw was found in the Linux kernel's driver for the ASIX AX88179178A-based...

Gom Player 2.3.92.5362 DLL Hijacking Vulnerability

Exploit Title: Gom Player 2.3.92.5362 - nvcuda.dll DLL Hijacking Exploit Author: Yehia Elghaly Mrvar0x Vendor Homepage: https://www.mrvar0x.com/ Version: 2.3.92.5362 Tested on: Windows 7, Windows 10 A DLL hijacking vulnerability has been discovered Gom Player 2.3.92.5362. When a user loads the...

CVE-2023-49961

CVE-2023-49961 affects WALLIX Bastion (7.x–10.x) and WALLIX Access Manager (3.x–4.x) due to an Incorrect Access Control flaw that can lead to sensitive data exposure. Root cause: improper access-control checks exposing data. CVSS v3.1 base score 7.5 (HIGH). No exploitation details are provided in...

WordPress Contact Form 7 Extension For Mailchimp Plugin <= 0.5.70 is vulnerable to Server Side Request Forgery (SSRF)

Software Contact Form 7 Extension For Mailchimp Type Plugin Vulnerable versions = 0.5.70 Fixed in N/A OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-22134 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID...

Gom Player 2.3.92.5362 Buffer Overflow

Exploit Title: Gom Player 2.3.92.5362 - Buffer Overflow PoC Discovered by: Yehia Elghaly Mrvar0x Discovered Date: 04.01.2024 Vendor Homepage: https://www.gomlab.com/en Tested Version: 2.3.92.5362 Tested on: Windows 7, Windows 10 - Open GOM Player - Click on the settings - From the menu, select...

Gom Player 2.3.92.5362 Buffer Overflow Exploit

Exploit Title: Gom Player 2.3.92.5362 - Buffer Overflow PoC Discovered by: Yehia Elghaly Mrvar0x Vendor Homepage: https://www.gomlab.com/en Tested Version: 2.3.92.5362 Tested on: Windows 7, Windows 10 - Open GOM Player - Click on the settings - From the menu, select Audio -- Equalizer - Click on...

webmail.migiboy.com Cross Site Scripting vulnerability OBB-3829523

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

airhm.net Cross Site Scripting vulnerability OBB-3829458

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Advanced Form Integration < 1.76.0 - Authenticated(Administrator+) SQL Injection

Description The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 1.76.0 exclusive due to insufficient escaping on the user supplied parameter a...

WordPress Void Contact Form 7 Widget For Elementor Page Builder Plugin <= 2.3 is vulnerable to Broken Access Control

Software Void Contact Form 7 Widget For Elementor Page Builder Type Plugin Vulnerable versions = 2.3 Fixed in 2.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52214 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f8cc742c5d75...

Oracle Linux 7 : tigervnc (ELSA-2024-0006)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0006 advisory. - Dropped xorg-CVE-2023-5367.patch, xorg-CVE-2023-6377.patch, and xorg-CVE-2023-6478.patch - Updated fix for CVE-2023-6377 tigervnc: xorg-x11-server:...

Oracle Linux 7 : xorg-x11-server (ELSA-2024-0009)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0009 advisory. 1.20.4-25 - CVE fix for: CVE-2023-6377, CVE-2023-6478 Resolves: https://issues.redhat.com/browse/RHEL-18416 Resolves:...

CentOS 7 : thunderbird (RHSA-2024:0027)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0027 advisory. - The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not...

Oracle Linux 7 : thunderbird (ELSA-2024-0027)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-0027 advisory. 115.6.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build 115.6.0-1 - Update to...

CentOS 7 : firefox (RHSA-2024:0026)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0026 advisory. - The WebGL DrawElementsInstanced method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow...

[SECURITY] [DLA 3705-1] php-guzzlehttp-psr7 security update

Debian LTS Advisory DLA-3705-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin December 31, 2023 https://wiki.debian.org/LTS Package : php-guzzlehttp-psr7 Version : 1.4.2-0.1+deb10u2 CVE ID : CVE-2023-29197 Debian Bug : 1034581 It was discovered that...

CVE-2023-7186

CVE-2023-7186 affects 7-card Fakabao up to version 1.0_build20230805, with a vulnerability in member/notify.php. The issue arises from improper handling of the out_trade_no argument, enabling SQL injection. Multiple sources (NVD/NVD-enriched records and related feeds) confirm this is a public, di...

CVE-2023-7185

CVE-2023-7185 affects 7-card Fakabao up to version 1.0_build20230805. A SQL injection vulnerability exists in the file shop/wxpay_notify.php, triggered by manipulating the argument out_trade_no. The vulnerability’s root cause is tied to an unknown function in that file. It is classified as critic...

CVE-2023-7183

A vulnerability has been found in 7-card Fakabao up to 1.0build20230805 and classified as critical. Affected by this vulnerability is an unknown functionality of the file shop/alipaynotify.php. The manipulation of the argument outtradeno leads to sql injection. The exploit has been disclosed to t...