CVE-2023-1650

The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog...

NETGEAR SRX5308 Cross-Site Scripting Vulnerability (CNVD-2023-43019)

The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from an incorrect operation of the parameter smtpServer.fromAddr. The vulnerability can be exploited by an attacker to obtain sensitive information...

NETGEAR SRX5308 Cross-Site Scripting Vulnerability

The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from an incorrect operation of the parameter sysLogInfo.serverName, which can be exploited by an attacker to obtain sensitive information such as use...

NETGEAR SRX5308 Cross-Site Scripting Vulnerability (CNVD-2023-43026)

The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from a misuse of the parameter dhcp.SecDnsIPByte2. The vulnerability can be exploited by an attacker to obtain sensitive information such as user...

NETGEAR SRX5308 Cross-Site Scripting Vulnerability (CNVD-2023-43020)

The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from incorrect manipulation of the parameter ntp.server1. The vulnerability can be exploited by an attacker to obtain sensitive information such as...

NETGEAR SRX5308 Cross-Site Scripting Vulnerability (CNVD-2023-43018)

The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from incorrect manipulation of the parameter smtpServer.emailServer. The vulnerability can be exploited by an attacker to obtain sensitive informatio...

NETGEAR SRX5308 Cross-Site Scripting Vulnerability (CNVD-2023-43024)

The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that stems from an incorrect manipulation of the parameter wanName. The vulnerability can be exploited by an attacker to obtain sensitive information such as user...

NETGEAR SRX5308 Cross-Site Scripting Vulnerability (CNVD-2023-43021)

The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from a misuse of the parameter ntp.server2. The vulnerability can be exploited by an attacker to obtain sensitive information such as user cookies...

NETGEAR SRX5308 Cross-Site Scripting Vulnerability (CNVD-2023-43027)

The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from an incorrect operation of the parameter IpsecIKEPolicy.IKEPolicyName. The vulnerability can be exploited by an attacker to obtain sensitive...

NETGEAR SRX5308 Cross-Site Scripting Vulnerability (CNVD-2023-43023)

The NETGEAR SRX5308 is a VPN firewall appliance from NETGEAR. The NETGEAR SRX5308 suffers from a cross-site scripting vulnerability that originates from a misuse of the parameter ConfigPort.LogicalIfName. An attacker can exploit this vulnerability to obtain sensitive information such as user...

New Atomic Stealer MacOS malware Steals Browser Cookies and Cryptocurrency Wallets

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Atomic Stealer malware is a full-featured infostealer designed to steal sensitive data from macOS users. The malware can grab account passwords, browser data, session cookies, and crypto-wallets. To...

DEBIAN-CVE-2023-30861

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session...

UBUNTU-CVE-2023-30861

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session...

PYSEC-2023-62

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session...

CVE-2023-30861

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session...

Amazon Linux 2 : tomcat (ALAS-2023-2020)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2020 advisory. 2023-05-11: CVE-2017-12616 was added to this advisory. When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 ...

Important: tomcat

Issue Overview: When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. CVE-2017-12616 When using the RemoteIpFilter with...

Vietnamese Threat Actor Infects 500,000 Devices Using 'Malverposting' Tactics

A Vietnamese threat actor has been attributed as behind a "malverposting" campaign on social media platforms to infect over 500,000 devices worldwide over the past three months to deliver variants of information stealers such as S1deload Stealer and SYS01stealer. Malverposting refers to the use o...

PT-2023-2566

Name of the Vulnerable Software and Affected Versions Flask versions prior to 2.3.2 Flask versions prior to 2.2.5 Description The issue arises when a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches...

GHSA-8595-6653-96P2 phpMyFAQ vulnerable to Stored Cross-site Scripting

phpMyFAQ prior to version 3.1.13 has a stored cross site scripting vulnerability in name field in add question module. This allows an attacker to steal user cookies...