4515 matches found
PT-2023-27670 · Tenda · Tenda Ac6
Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 Description: The issue is related to a Buffer Overflow that can be triggered via the formWifiBasicSet function. Recommendations: For version 15.03.05.16, consider disabling the formWifiBasicSet function as a...
DarkGate Malware Activity Spikes as Developer Rents Out Malware to Affiliates
A new malspam campaign has been observed deploying an off-the-shelf malware called DarkGate. "The current spike in DarkGate malware activity is plausible given the fact that the developer of the malware has recently started to rent out the malware to a limited number of affiliates," Telekom...
CVE-2023-40585 Unauthenticated access to Ironic API
ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not have API and Conductor split into separate services, access to the API is not protected by any authentication. Ironic API is also listenin...
CVE-2023-39809
N.V.K.INTER CO., LTD. NVK iBSG v3.5 was discovered to contain an OS command injection vulnerability via shell metacharacters in the systemhostname parameter at /manage/network-basic.php...
CVE-2023-39809
N.V.K.INTER CO., LTD. NVK iBSG v3.5 was discovered to contain a command injection vulnerability via the systemhostname parameter at /manage/network-basic.php...
N.V.K.INTER iBSG 命令注入漏洞
N.V.K.INTER iBSG NVK iBSG is a security appliance from N.V.K.INTER, Inc. A security vulnerability exists in N.V.K.INTER iBSG version v3.5, which originates from a command injection vulnerability in the parameter systemhostname in the file /manage/network-basic.php...
CVE-2023-40171 Dispatch writes JWT tokens in error message
Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the Dispatch Plugin - Basic Authentication Provider plugin encounters an error when attempting to decode a JWT token. Any Dispatch users...
CVE-2023-21230
In onAccessPointChanged of AccessPointPreference.java, there is a possible way for unprivileged apps to receive a broadcast about WiFi access point change and its BSSID or SSID due to a precondition check failure. This could lead to local information disclosure with no additional execution...
CVE-2023-39828
Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the security parameter in the formWifiBasicSet function...
CVE-2023-34476 Extension - mooj.org - SQLi in Proforms Basic component for Joomla <= 1.6.0
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability allows SQL Injection...
CVE-2023-34476 Extension - mooj.org - SQLi in Proforms Basic component for Joomla <= 1.6.0
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability allows SQL Injection...
Joomla! Proforms Basic SQL Injection Vulnerability
Joomla! is a set of forum components used in the Joomla! content management system. A security vulnerability exists in Joomla! Proforms Basic that stems from improper neutralization of special elements, which can lead to SQL injection...
PT-2023-24901 · Mooj.Org +1 · Proforms Basic Component For Joomla +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to an SQL Injection vulnerability due to the improper neutralization of special elements used in an SQL command. This allows for SQ...
Authentication Bypass
gitlab is vulnerable to Authentication Bypass. The vulnerability allows an attacker to bypass 2FA for LDAP users and access some specific pages with Basic Authentication...
Information Exposure
Overview logstash-core is a scalable log and event management tool. Affected versions of this package are vulnerable to Information Exposure. Elasticsearch Output plugin would log to file HTTP basic auth credentials when updating connections after sniffing. Remediation Upgrade logstash-core to...
HotRat: New Variant of AsyncRAT Malware Spreading Through Pirated Software
A new variant of AsyncRAT malware dubbed HotRat is being distributed via free, pirated versions of popular software and utilities such as video games, image and sound editing software, and Microsoft Office. "HotRat malware equips attackers with a wide array of capabilities, such as stealing login...
Cybercriminals Exploit Microsoft Word Vulnerabilities to Deploy LokiBot Malware
Microsoft Word documents exploiting known remote code execution flaws are being used as phishing lures to drop malware called LokiBot on compromised systems. "LokiBot, also known as Loki PWS, has been a well-known information-stealing Trojan active since 2015," Fortinet FortiGuard Labs researcher...
Authentication flaw
The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic authentication...
CVE-2023-33868
CVE-2023-33868 concerns an authentication flaw in PiiGAB M-Bus software (notably the 900S family). The root issue is an unlimited number of login attempts, enabling brute-force against HTTP basic authentication. Public sources (NVD, CVE list, PRION, ics-advisory) consistently describe this vulner...