CVE-2021-41750

A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...

Nystudio107 Seomatic 跨站脚本漏洞

Nystudio107 Seomatic is a comprehensive, powerful and flexible turnkey SEO system in the USA. Facilitates modern SEO best practices and implementation of Craft CMS 3. A security vulnerability exists in Nystudio107 Seomatic version 3.4.10, which can be exploited by a remote attacker to inject...

Pulsar - Data Exfiltration And Covert Communication Tool

Pulsar is a tool for data exfiltration and covert communication that enable you to create a secure data transfer, a bizarre chat or a network tunnel through different protocols, for example you can receive data from tcp connection and resend it to real destination through DNS packets. Setting up...

Important: aide

Issue Overview: A heap-based buffer overflow vulnerability in the base64 functions of AIDE, an advanced intrusion detection system. An attacker could crash the program and possibly execute arbitrary code through large 16k extended file attributes or ACL. CVE-2021-45417 Affected Packages: aide Iss...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134 Confluence OGNL expression injected RCECVE-202...

Malicious code in @image-process-library/blob-to-base64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d97f201a6169602b9dcfdcb3be126c7d1f1a71e3aa1dab3330d18f7437f199f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-352 Malicious code in @image-process-library/blob-to-base64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d97f201a6169602b9dcfdcb3be126c7d1f1a71e3aa1dab3330d18f7437f199f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Popular PyPI Package 'ctx' and PHP Library 'phpass' Hijacked to Steal AWS Keys

Two trojanized Python and PHP packages have been uncovered in what's yet another instance of a software supply chain attack targeting the open source ecosystem. One of the packages in question is "ctx," a Python module available in the PyPi repository. The other involves "phpass," a PHP package...

Exploit for Unrestricted Upload of File with Dangerous Type in Artica Pandora_Fms

Exploit for CVE-2020-5844 Pandora FMS v7.0NG.742 - Remote Co...

new packages: perl-MIME-Base64

An update is available for perl-MIME-Base64. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Jenkins Subversion Plugin Stores Credentials with Base64 Encoding

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file...

GHSA-C4FR-GX5W-8QF2 Jenkins Subversion Plugin Stores Credentials with Base64 Encoding

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file...

Exploit for Code Injection in Vmware Spring_Cloud_Gateway

CVE-2022-22947 Spring Cloud Gateway Actuator API SpEL expres...

Custom PowerShell RAT targets Germans seeking information about the Ukraine crisis

This blog post was authored by Hossein Jazi and Jérôme Segura Populations around the world—and in Europe in particular—are following the crisis in Ukraine very closely, and with events unfolding on a daily basis, people are hungry for information. Although all countries have reasons to be...

GHSA-63QJ-P8GH-5XXX Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0

rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request...

Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0

rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request...

CVE-2021-27770

The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting will take place...

Design/Logic Flaw

The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting will take place...

PT-2022-9858 · Hcl +1 · Sametime

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue was discovered within the FaviconService, which takes a base64-encoded URL and requests it through the webserver. It is assumed that this...

Security Bulletin: IBM Sterling Order Management is affected by a vulnerability (CVE-2016-5953)

Summary IBM Sterling Order Management is vulnerable by exposing the session identifier on an error page Vulnerability Details CVEID: CVE-2016-5953 DESCRIPTION: IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not...