Privilege escalation

An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-47053

An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-47053

An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-47053

An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file...

PT-2023-15146

Name of the Vulnerable Software and Affected Versions DNN Corp DotNetNuke versions 7.0.0 through 9.10.2 Description An arbitrary file upload vulnerability in the Digital Assets Manager module allows attackers to execute arbitrary code via a crafted SVG file. Recommendations For versions 7.0.0...

CVE-2022-47053: Improper Neutralization of Input During Web Page Generation

An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-47053

An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-47053

Summary: CVE-2022-47053 affects DNN (DotNetNuke) Digital Assets Manager, across DotNetNuke v7.0.0 through v9.10.2, enabling arbitrary code execution via a crafted SVG file through an arbitrary file upload vulnerability. The available connected documents consistently describe the vulnerability cla...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to Webpack (CVE-2023-28154)

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to Webpack CVE-2023-28154 with details below. Vulnerability Details CVEID:CVE-2023-28154 DESCRIPTION: Webpack could allow a remote attacker to bypass security restrictions, caused by the mishandling o...

Supply Chain Attacks and Critical Infrastructure: How CISA Helps Secure a Nation's Crown Jewels

Critical infrastructure attacks are a preferred target for cyber criminals. Here's why and what's being done to protect them. What is Critical Infrastructure and Why is It Attacked? Critical infrastructure is the physical and digital assets, systems and networks that are vital to national securit...

CVE-2023-26775

File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the assets/php/upload.php endpoint...

CVE-2023-26775

File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the assets/php/upload.php endpoint...

PT-2023-20790 · Monitorr · Monitorr

Name of the Vulnerable Software and Affected Versions: Monitorr version 1.7.6 Description: A remote attacker can execute arbitrary code via a crafted file upload to the "assets/php/upload.php" endpoint. This allows for the potential execution of malicious code on the affected system...

CVE-2023-26775: Unrestricted Upload of File with Dangerous Type

File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the assets/php/upload.php endpoint...

CVE-2023-26775

Summary: CVE-2023-26775 affects Monitorr v1.7.6, where a crafted file upload to assets/php/upload.php can lead to remote arbitrary code execution. The NVD/Red Hat/CIRCL OSV entries confirm the same issue with high severity (CVSS 3.1 base score 7.8). Impact: remote attacker could execute code by u...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Node.js

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Node.js with details below. Vulnerability Details CVEID:CVE-2023-23918 DESCRIPTION: Node.js could allow a remote authenticated attacker to bypass security restrictions,...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Go

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Go with details below. Vulnerability Details CVEID:CVE-2022-41723 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the HPACK decoder. By...

Adding a new derivate will splits new user's underlying shares in the new derivate to older users

Lines of code Vulnerability details Vulnerability details Impact After a derivate is added to the protocol. Older users will take some new user's share in the new derivate. The addDerivative function add a new derivate to the protocol. The newly added derivate has zero underlying balance. Users w...

sFrxEth may revert on redeeming non-zero amount

Lines of code Vulnerability details Impact Unstaking is blocked. Proof of Concept When unstaking the withdraw of each derivative is called. SfrxEth.withdraw calls IsFrxEthSFRXETHADDRESS.redeemamount, addressthis, addressthis;. This function may revert if amount is low due to the following line in...

Risk Fact #2: Automation Is the Difference Between Success and Failure

Qualys Blog Series – Threat Research Unit Report Organizational leaders dread the consequences of a successful cyber-attack, which can be devastating due to data loss, reputational damage, and legal repercussions. Under the hood, security professionals are acutely focused on finding technical mea...