CVE-2023-3297

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process...

UBUNTU-CVE-2023-3297

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process...

CVE-2020-18418

A Cross site request forgery CSRF vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.php?s=Admin-Admin-Insert...

Cross site request forgery (csrf)

A Cross site request forgery CSRF vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.php?s=Admin-Admin-Insert...

CVE-2020-18418

A Cross site request forgery CSRF vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.php?s=Admin-Admin-Insert...

LearnDash LMS < 4.6.0.1 - User Account Takeover via Insecure Direct Object References

The plugin does not correctly manage access to system resources, resulting in Insecure Direct Object References. As a result, users can bypass authorization checks, leading to unauthorized changes to user passwords, potentially compromising administrator accounts...

CVE-2020-18418

A Cross site request forgery CSRF vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.php?s=Admin-Admin-Insert...

PT-2023-20582 · WordPress · Kivicare

Name of the Vulnerable Software and Affected Versions: KiviCare WordPress plugin versions prior to 3.2.1 Description: The issue concerns the lack of CSRF checks in various AJAX actions, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks. This includes...

CVE-2020-18418

The provided documents identify a CSRF vulnerability in FeiFeiCMS v4.1.190209 that lets an attacker create administrator accounts via /index.php?s=Admin-Admin-Insert. The CVE entry CVE-2020-18418 notes this is a high-severity issue (CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; base score 8.8)....

Shopware 代码问题漏洞

Shopware is a suite of open source e-commerce software from the German company Shopware. A code issue vulnerability exists in Shopware versions prior to 5.7.18 that stems from some flaws in the email validation during the registration process, so that different email addresses may be constructed,...

PT-2023-24671 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 5.7.18 Description: The mail validation in the registration process had flaws, allowing the construction of different mail addresses that result in the same address, which can be shared by multiple accounts...

The software vulnerabilities of the EcoStruxure EV Charging Expert parking charging stations allow a violator to modify system settings or user accounts.

The vulnerability of the EcoStruxure EV Charging Expert parking charging station software is related to incorrect restrictions on the visible layers or frames of the user interface. Exploiting this vulnerability could allow an attacker to remotely modify system settings or user accounts...

Twitter Hacker Sentenced to 5 Years in Prison for $120,000 Crypto Scam

A U.K. citizen who took part in the massive July 2020 hack of Twitter has been sentenced to five years in prison in the U.S. Joseph James O'Connor aka PlugwalkJoe, 24, was awarded the sentence on Friday in the Southern District of New York, a little over a month after he pleaded guilty to the...

msLDAPDump - LDAP Enumeration Tool

msLDAPDump simplifies LDAP enumeration in a domain environment by wrapping the lpap3 library from Python in an easy-to-use interface. Like most of my tools, this one works best on Windows. If using Unix, the tool will not resolve hostnames that are not accessible via eth0 currently. Binding...

Design/Logic Flaw

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login...

CVE-2023-28800 Output encoding missing in redrurl parameter

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login...

CVE-2023-28800 Output encoding missing in redrurl parameter

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login...

Generative-AI apps & ChatGPT: Potential risks and mitigation strategies

Losing sleep over Generative-AI apps? You're not alone or wrong. According to the Astrix Security Research Group, mid size organizations already have, on average, 54 Generative-AI integrations to core systems like Slack, GitHub and Google Workspace and this number is only expected to grow. Contin...

Generative-AI apps & ChatGPT: Potential risks and mitigation strategies

Losing sleep over Generative-AI apps? You're not alone or wrong. According to the Astrix Security Research Group, mid size organizations already have, on average, 54 Generative-AI integrations to core systems like Slack, GitHub and Google Workspace and this number is only expected to grow. Contin...

PT-2023-21662 · WordPress · Bookit

Name of the Vulnerable Software and Affected Versions: BookIt plugin for WordPress versions up to, and including, 2.3.7 Description: The BookIt plugin for WordPress has an authentication bypass issue due to insufficient verification of the user being supplied during booking an appointment through...