XWiki Platform Security Vulnerability

XWiki Platform is a suite of Wiki platforms from the XWiki Foundation in France for creating collaborative Web applications. A security vulnerability exists in XWiki Platform, which arises from the fact that an attacker with editing privileges on any document can move any attachment from any othe...

PT-2023-26181 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 3.5-milestone-1 through 14.10.7 XWiki Platform versions 15.3-rc-1 and earlier Description: Triggering the office converter with a specially crafted file name allows writing the attachment's content to an...

The outstanding stealth of Operation Triangulation

Introduction In our previous blogpost on Triangulation, we discussed the details of TriangleDB, the main implant used in this campaign, its C2 protocol and the commands it can receive. We mentioned, among other things, that it is able to execute additional modules. We also mentioned that this...

CVE-2023-43986

DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken...

DM Concept configurator SQL Injection Vulnerability

DM Concept configurator is an application from DM Concept, Inc. A security vulnerability exists in DM Concept configurator versions prior to v4.9.4 that stems from a SQL injection vulnerability in the component ConfiguratorAttachment...

CVE-2023-45902

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/attachment/delete...

CVE-2023-45902

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/attachment/delete...

CVE-2023-45902

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/attachment/delete...

Cross site request forgery (csrf)

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/attachment/delete...

CVE-2023-45902

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/attachment/delete...

Dreamer CMS Cross-Site Request Forgery Vulnerability

Dreamer CMS is a dreamer content management system by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS version v4.1.3. An attacker can exploit this vulnerability to conduct cross-site request forgery CSRF attacks via the component...

PT-2023-29756 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component "/admin/attachment/delete". This issue allows for unauthorized requests to be made on behalf of a user. Recommendations: For Dreame...

Peeling off QR Code Phishing Onion

Peeling off QR Code Phishing Onion: Revealing the Hidden Layers of Deceit By Neel H. Pathak and Pratik Sunil Kadam · October 10, 2023 Introduction: Malicious actors always seek innovative ways to bypass detection. The Trellix Advanced Research Center recently noticed an attack campaign with an...

WooCommerce Product Attachment < 2.2.0 - Checkout Attachements Update via CSRF

Description The plugin does not have CSRF check when saving checkout attachements, which could allow attackers to make logged in users perform such action via a CSRF attack...

CVE-2023-5331 File Information Leak via IDOR in file_id in Draft Posts

Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information...

Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that stems from a failure to properly check the creator of an attachment when adding it to a draft post, which could lead to information disclosure...

CVE-2023-40212

Cross-Site Request Forgery CSRF vulnerability in theDotstore Product Attachment for WooCommerce plugin = 2.1.8 versions...

CVE-2023-40212

Cross-Site Request Forgery CSRF vulnerability in theDotstore Product Attachment for WooCommerce plugin = 2.1.8 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in theDotstore Product Attachment for WooCommerce plugin = 2.1.8 versions...

CVE-2023-40212 WordPress WooCommerce Product Attachment Plugin <= 2.1.8 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in theDotstore Product Attachment for WooCommerce plugin = 2.1.8 versions...