CVE-2024-26791 btrfs: dev-replace: properly validate device names

In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getnamekerne...

CVE-2024-26791

CVE-2024-26791 — Linux kernel: btrfs dev-replace: properly validate device names. A syzbot report indicated device name buffers passed to device replace could read beyond end (getname_kernel) due to insufficient termination checks. The fix adds a helper that validates both source and target devic...

CVE-2024-26791

In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getnamekerne...

CVE-2024-31105

Cross-Site Request Forgery CSRF vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issue affects Tax Rate Upload: from n/a through 2.4.5...

CVE-2024-31105

CVE-2024-31105 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Tax Rate Upload that enables Reflected XSS. The entry lists affected software as Tax Rate Upload (n/a) up to version 2.4.5. Reported metrics (CVSS v3.1 base score 7.1, HIGH) indicate network attack vector,...

Magic Security Dust

Adam Shostack is selling magic security dust. Its about time someone is commercializing this essential technology...

Thread Hijacking: Phishes That Prey on Your Curiosity

Thread hijacking attacks. They happen when someone you know has their email account compromised, and you are suddenly dropped into an existing conversation between the sender and someone else. These missives draw on the recipients natural curiosity about being copied on a private discussion, whic...

Fat Patch Tuesday, February 2024 Edition

Microsoft Corp. today pushed software updates to plug more than 70 security holes in its Windows operating systems and related products, including two zero-day vulnerabilities that are already being exploited in active attacks. Top of the heap on this Fat Patch Tuesday is CVE-2024-21412, a...

unpkg.com Improper Access Control vulnerability OBB-3780532

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Flarum vulnerable to LFI and Blind SSRF via Avatar upload

Impact The Flarum forum software is affected by a vulnerability that allows an attacker to conduct a Blind SSRF attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulat...

OSX Meterpreter, Reverse HTTPS Inline

Run the Meterpreter / Mettle server payload stageless Module Options msf use payload/osx/aarch64/meterpreterreversehttps msf payloadmeterpreterreversehttps show actions ...actions... msf payloadmeterpreterreversehttps set ACTION msf payloadmeterpreterreversehttps show options ...show and set...

Instagram's Twitter Alternative 'Threads' Launch Halted in Europe Over Privacy Concerns

Instagram Threads, the upcoming Twitter competitor from Meta, will not be launched in the European Union due to privacy concerns, according to Ireland's Data Protection Commission DPC. The development was reported by the Irish Independent, which said the watchdog has been in contact with the soci...

CVE-2023-1508

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Adam Retail Automation Systems Mobilmen Terminal Software allows SQL Injection. This issue affects Mobilmen Terminal Software: before 3...

CVE-2023-1508

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Adam Retail Automation Systems Mobilmen Terminal Software allows SQL Injection.This issue affects Mobilmen Terminal Software: before 3...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Adam Retail Automation Systems Mobilmen Terminal Software allows SQL Injection.This issue affects Mobilmen Terminal Software: before 3...

CVE-2023-1508

Summary: A SQL Injection vulnerability in Adam Retail Automation Systems Mobilmen Terminal Software (Mobilmen Terminal Software) affects versions before 3 due to improper neutralization of special elements in SQL commands. Impact: high confidentiality, integrity, and availability (CVSS v3.1 base ...

Adam Retail Automation Systems Mobilmen Terminal Software 3 SQL注入漏洞

Adam Retail Automation Systems Mobilmen Terminal Software is a retail automation system terminal software. A SQL injection vulnerability exists in versions prior to Adam Retail Automation Systems Mobilmen Terminal Software 3, which arises from improper neutralization of specific elements used,...

adam-marsden.co.uk Cross Site Scripting vulnerability OBB-3281456

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

adamleech.net Cross Site Scripting vulnerability OBB-3275225

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

adam-boissons.fr Cross Site Scripting vulnerability OBB-3263106

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...