Exploit for Improper Input Validation in Usememos Memos

CVE-2023-4698 Local File Inclusion LFI in usememos/memos...

PT-2023-26242 · WordPress · Dharmesh Patel Post List With Featured Image

Name of the Vulnerable Software and Affected Versions: Dharmesh Patel Post List With Featured Image plugin versions 1.2 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

PT-2023-20084 · WordPress · Mahlamusa Who Hit The Page – Hit Counter

Name of the Vulnerable Software and Affected Versions: Mahlamusa Who Hit The Page – Hit Counter plugin versions = 1.4.14.3 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-24719 · WordPress · Kaplugins Google Fonts For Wordpress

Name of the Vulnerable Software and Affected Versions: KAPlugins Google Fonts For WordPress plugin versions = 3.0.0 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

Moxa ioLogik 4000 Series Incorrect Authorization (CVE-2023-4227)

A vulnerability has been identified in the ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft, and unauthorized manipulation of...

CVE-2023-4227

A vulnerability has been identified in the ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft, and unauthorized manipulation of...

CVE-2023-4227

A vulnerability has been identified in the ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft, and unauthorized manipulation of...

Information disclosure

A vulnerability has been identified in the ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft, and unauthorized manipulation of...

CVE-2023-4227

CVE-2023-4227 affects ioLogik 4000 Series (ioLogik E4200) firmware v1.6 and earlier. Root cause is the presence of an unauthorized service that could enable unauthorized access to the device, potentially leading to security breaches and data theft. Public documents do not provide a confirmed fix ...

CVE-2023-4227 ioLogik 4000 Series: Existence of an Unauthorized Service

A vulnerability has been identified in the ioLogik 4000 Series ioLogik E4200 firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data theft, and unauthorized manipulation of...

User Registration & Login and User Management System v3.0 - SQL Injection (Unauthenticated)

Exploit Title: User Registration & Login and User Management System v3.0 - SQL Injection Unauthenticated Google Dork: NA Date: 19/08/2023 Exploit Author: Ashutosh Singh Umath Vendor Homepage: https://phpgurukul.com Software Link:...

Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders.

In large metropolitan areas, tourists are often easy to spot because theyre far more inclined than locals to gaze upward at the surrounding skyscrapers. Security experts say this same tourist dynamic is a dead giveaway in virtually all computer intrusions that lead to devastating attacks like dat...

QR codes used to phish for Microsoft credentials

Researchers have published details about a phishing campaign that uses QR codes to phish for Microsoft credentials. A QR Quick Response code is a kind of two-dimensional barcode that holds encoded data in a graphical black-and-white pattern. The data that a QR code stores can include URLs, email...

A week in security (August 14 - August 20)

Last week on Malwarebytes Labs: Attackers demand ransoms for stolen LinkedIn accounts Patch now! Citrix Sharefile joins the list of actively exploited file sharing software Exchange Server security updates updated Catching up with WoofLocker, the most elaborate traffic redirection scheme to tech...

Cross-Site Request Forgery (CSRF)

gin is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability occurs because the plugin does not require POST requests for an HTTP endpoint, which allows allows an attacker to copy a malicious folder, which could then be used to steal data or execute arbitrary code...

PT-2023-23616 · Fahad Mahmood · Fahad Mahmood Wp Docs

Name of the Vulnerable Software and Affected Versions: Fahad Mahmood WP Docs plugin versions prior to 1.9.9 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowi...

PT-2023-23619 · Unknown · Ignazio Scimone Albo Pretorio On Line

Name of the Vulnerable Software and Affected Versions: Ignazio Scimone Albo Pretorio On line plugin versions = 4.6.3 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potential...

WebChess SQL Injection Vulnerability (CNVD-2023-64111)

WebChess is a web-based online chess game. A SQL injection vulnerability exists in webchess v1.0, which originates from the lack of validation of the $playerID parameter in mainmenu.php against external SQL input. This vulnerability can be exploited by attackers to execute illegal SQL commands to...

PT-2023-23134 · Unknown · Yannick Lefebvre Modal Dialog

Name of the Vulnerable Software and Affected Versions: Yannick Lefebvre Modal Dialog plugin versions = 3.5.14 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them t...

Online Travel Agency System SQL注入漏洞

Online Travel Agency System is an online travel agency system. A SQL injection vulnerability exists in Online Travel Agency System v1.0, which originates from a lack of validation of the articleedit.php parameter pageid against an externally-entered SQL statement. An attacker can exploit this...