matrix-appservice-irc IRC command injection via admin commands containing newlines

Impact It is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Patches Versions 1.0.1 and above are patched. Workarounds There are no robust workaround...

GHSA-3PMJ-JQQP-2MJ3 matrix-appservice-irc IRC command injection via admin commands containing newlines

Impact It is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Patches Versions 1.0.1 and above are patched. Workarounds There are no robust workaround...

CVE-2023-38690

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0....

Design/Logic Flaw

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0....

CVE-2023-38690 matrix-appservice-irc IRC command injection via admin commands containing newlines

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0....

CVE-2023-38690 matrix-appservice-irc IRC command injection via admin commands containing newlines

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0....

MTE As Implemented, Part 3: The Kernel

By Mark Brand, Project Zero Background In 2018, in the v8.5a version of the ARM architecture, ARM proposed a hardware implementation of tagged memory, referred to as MTE Memory Tagging Extensions. In Part 1 we discussed testing the technical and implementation limitations of MTE on the hardware...

CVE-2022-24403

creationtimestamp| type| source ---|---|--- 2023-07-25 19:29:22+00:00| seen| https://t.me/truesecator/4656 2024-04-26 21:54:48+00:00| seen| https://t.me/darkcommunityofficial/482...

CVE-2023-3613

Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default...

Default credentials

Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default...

CVE-2023-3613 Guest accounts invited and added to channels by Welcomebot plugin

Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default...

CVE-2023-3613 Guest accounts invited and added to channels by Welcomebot plugin

Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default...

CVE-2023-3613 Guest accounts invited and added to channels by Welcomebot plugin

Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default...

CVE-2023-3613

Summary: CVE-2023-3613 relates to the Mattermost WelcomeBot plugin. The issue is a failure to validate membership status when inviting or adding users to channels, which can allow guest accounts to be added or invited by default. Affected software/component (from sources): Mattermost WelcomeBot p...

CVE-2023-3582 Lack of channel membership check when linking a board to a channel

Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to,...

PT-2023-25440 · Mattermost · Mattermost Welcomebot Plugin

Name of the Vulnerable Software and Affected Versions: Mattermost WelcomeBot plugin affected versions not specified Description: The Mattermost WelcomeBot plugin fails to validate the membership status when inviting or adding users to channels, allowing guest accounts to be added or invited to...

The vulnerability of the TrustZone subsystem’s networking (netdev) component in Qualcomm embedded operating systems allows a hacker to gain unauthorized access to protected information.

The vulnerability of the TrustZone subsystem for networking functions in Qualcomm embedded systems’ operating systems lies in the insufficient protection of sensitive data during the analysis of peripheral channels. Exploiting this vulnerability can allow attackers to gain unauthorized access to...

New Meduza Malware Targets Wallets, Passwords and Browsers on Windows

By Deeba Ahmed Meduza malware is being fiercely marketed across different Telegram channels, cybercrime and dark web forums. This is a post from HackRead.com Read the original post: New Meduza Malware Targets Wallets, Passwords and Browsers on Windows...

aldryn-django (>=4.2.10.0 <=4.2.18.0), alertwise (=1.0.0) +114 more potentially affected by CVE-2023-36053 via django (>=4.2.0 <=4.2.29)

django PYPI version =4.2.0, =4.2.10.0, =65.10.0, =7.5.1, =1.0.2, =0.0.1, =1.3.9, =0.4.0, =0.0.1, =4.16.2, =4.8.0, =0.0.4.dev0, =8.0.0, =8.5.1 and more Source cves: CVE-2023-36053 Source advisory: OSV:GHSA-JH3W-4VVF-MJGR...

Researchers Use Power LED to Extract Encryption Keys in Groundbreaking Attack

By Deeba Ahmed This attack method can help attackers surpass all barriers to exploit side channels, which so far were not possible. This is a post from HackRead.com Read the original post: Researchers Use Power LED to Extract Encryption Keys in Groundbreaking Attack...