CVE-2024-41959 Cross-site Scripting (XSS) via API Logs in mailcow: dockerized

mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload into the API logs. This payload is executed whenever the API logs page is viewed, potentially allowing an attacker to run malicious scripts in the context of th...

CVE-2024-41959

CVE-2024-41959 affects mailcow: dockerized. An unauthenticated attacker can inject a JavaScript payload into the API logs, which is executed when the API logs page is viewed. This can enable malicious scripts to run in the user’s browser, potentially leading to unauthorized actions and data theft...

CVE-2024-41959 Cross-site Scripting (XSS) via API Logs in mailcow: dockerized

mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload into the API logs. This payload is executed whenever the API logs page is viewed, potentially allowing an attacker to run malicious scripts in the context of th...

CVE-2024-41959 Cross-site Scripting (XSS) via API Logs in mailcow: dockerized

mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload into the API logs. This payload is executed whenever the API logs page is viewed, potentially allowing an attacker to run malicious scripts in the context of th...

Low-Drama ‘Dark Angels’ Reap Record Ransoms

A ransomware group called Dark Angels made headlines this past week when it was revealed the crime group recently received a record $75 million data ransom payment from a Fortune 50 company. Security experts say the Dark Angels have been around since 2021, but the group doesnt get much press...

Apple fixes Siri vulnerabilities that could have allowed sensitive data theft from locked device. Update now!

Apple has released security updates for many of its products in order to patch several vulnerabilities that could allow an attacker to steal sensitive information from a locked device. Included in the patches for Apple Watch, iOS, and iPadOS are four vulnerabilities in Siri. While your device is...

Cross-Site Scripting (XSS)

com.jfinal, jfinal is vulnerable to Cross-site scripting. The vulnerability is due to improper input validation in the Title parameter in the /admin/content file, which can be manipulated to inject malicious scripts. Attackers can exploit this vulnerability remotely to execute arbitrary scripts i...

Online Bus Reservation Site 安全漏洞

Online Bus Reservation Site is an online bus reservation site. A SQL injection vulnerability exists in Online Bus Reservation Site version 1.0 due to a lack of validation of parameter Email against externally entered SQL statements. An attacker can exploit this vulnerability to execute illegal SQ...

ChurchCRM SQL Injection Vulnerability (CNVD-2024-35168)

ChurchCRM is an open source CRM system for churches. ChurchCRM 5.8.0 and prior versions suffer from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute illegal SQL commands t...

Weak Password Vulnerability in Data Decision System of Fansoft Software Co.

SailSoft Software Ltd. is a company dedicated to providing one-stop business intelligence solutions. A weak password vulnerability exists in the Data Decision System of SailSoft Software Limited, which can be exploited by attackers to obtain sensitive information...

Tailoring Management System SQL Injection Vulnerability

Tailoring Management System is itsourcecode open source a tailoring management system . Tailoring Management System version 1.0 SQL injection vulnerability , the vulnerability stems from the parameter title lack of validation of external input SQL statements . An attacker can exploit this...

ChurchCRM 安全漏洞

ChurchCRM is an open source CRM system for churches. ChurchCRM 5.8.0 and prior versions suffer from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute illegal SQL commands t...

SQL Injection Vulnerability in WisdomWater Business Charge Management System of New Day Technology Co. Ltd (CNVD-2024-36424)

Xintian Technology Co., Ltd. is an enterprise mainly engaged in the instrumentation manufacturing industry. A SQL injection vulnerability exists in the WisdomWater WisdomWater Business Charge Management System of Xintian Technology Co. Ltd. that can be exploited by attackers to obtain sensitive...

Windows SmartScreen Flaw Enabling Data Theft in Major Stealer Attack

New Stealer Campaign Exploits Windows SmartScreen Vulnerability CVE-2024-21412 - This large-scale attack targets Windows users, stealing passwords, browsing…...

Mini-Tmall SQL Injection Vulnerability

Mini-Tmall is a Spring Boot-based mini-Tmall mall , fast deployment run , suitable for use as a bijou template . SQL injection vulnerability exists in versions prior to Mini-Tmall v2024.07.03. The vulnerability stems from the application's lack of validation of externally entered SQL statements,...

dbt has an implicit override for built-in materializations from installed packages

Impact What kind of vulnerability is it? Who is impacted? When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt's functionality. However, this also mean...

Computer Laboratory Management System SQL注入漏洞

Computer Laboratory Management System is a computerized laboratory management system. A SQL injection vulnerability exists in Computer Laboratory Management System version 1.0 due to a lack of validation of externally entered SQL statements in the parameter id. An attacker can exploit this...

Document Management System SQL注入漏洞

Document Management System is a document management system. A SQL injection vulnerability exists in Document Management System version 1.0 due to a lack of validation of externally entered SQL statements in parameter anothercont. An attacker can exploit this vulnerability to execute illegal SQL...

Iraqi Hackers Exploit PyPI to Infiltrate Systems Through Python Packages

Python packages are being used to steal data from developers and companies. Learn about the extensive cybercriminal operation…...

Kaspersky Exits U.S. Market Following Commerce Department Ban

Russian security vendor Kaspersky has said it's exiting the U.S. market nearly a month after the Commerce Department announced a ban on the sale of its software in the country citing a national security risk. News of the closure was first reported by journalist Kim Zetter. The company is expected...