CVE-2023-2309

The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability...

CVE-2023-2309 wpForo Forum < 2.1.9 - Reflected Cross-Site Scripting

The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability...

WordPress Plugin wpForo Forum Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2023-18841 · WordPress · Wpforo Forum

Name of the Vulnerable Software and Affected Versions: wpForo Forum WordPress plugin versions prior to 2.1.9 Description: The issue is related to a Reflected Cross-Site Scripting vulnerability. It occurs because the plugin does not escape some request parameters while in debug mode...

CVE-2023-2309: Undefined Security Weakness

The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability...

PHP Debug Bar Enabled

The web application on the remote server has a PHP debug bar which is accessible without protection. A remote attacker can exploit this to gain more knowledge about the host, allowing an attacker to conduct further attacks. No source data...

Mozilla: Exposing Django Debug Panel and Sensitive Infrastructure Information at https://dev.fxprivaterelay.nonprod.cloudops.mozgcp.net

The Django Debug Panel was exposed in a development environment, allowing sensitive infrastructure information to be accessed. This included details about the locations of databases, user information, and internal IP addresses. The exposure of this information posed significant security risks and...

PimpMyLog v1.7.14 - Improper access control Exploit

Exploit Title: PimpMyLog v1.7.14 - Improper access control Exploit Author: thoughtfault Vendor Homepage: https://www.pimpmylog.com/ Software Link: https://github.com/potsky/PimpMyLog Version: 1.5.2-1.7.14 Tested on: Ubuntu 22.04 CVE : N/A Description: PimpMyLog suffers from improper access contro...

Exploit for Double Free in Xhttp_Project Xhttp

CVE-2023-38434 xHTTP commit 72f812d and below suffers from a...

VX-API - Collection Of Various Malicious Functionality To Aid In Malware Development

The VX-API is a collection of malicious functionality to aid in malware development. It is recommended you clone and/or download this entire repo then open the Visual Studio solution file to easily explore functionality and concepts. Some functions may be dependent on other functions present with...

Apple DCERPC allocation hint uninitialized memory disclosure vulnerability

Talos Vulnerability Report TALOS-2022-1675 Apple DCERPC allocation hint uninitialized memory disclosure vulnerability July 13, 2023 CVE Number None SUMMARY An information disclosure vulnerability exists in the call fault reporting functionality of DCERPC library as used in Apple macOS 12.6.1 that...

yaraQA - YARA Rule Analyzer To Improve Rule Quality And Performance

YARA rule Analyzer to improve rule quality and performance Why? YARA rules can be syntactically correct but still dysfunctional. yaraQA tries to find and report these issues to the author or maintainer of a YARA rule set. The issues yaraQA tries to detect are e.g.: rules that are syntactically...

PT-2023-7305 · Zyxel · Zyxel Nwa50Ax +8

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 4.32 through 5.37 Zyxel USG FLEX series versions 4.50 through 5.37 Zyxel USG FLEX 50W series versions 4.16 through 5.37 Zyxel USG20W-VPN series versions 4.16 through 5.37 Zyxel VPN series versions 4.30 through 5.37...

com.github.mizosoft.methanol:benchmarks (>=1.1.0, <=1.2.0), com.github.mizosoft.methanol:methanol-testutils (>=1.1.0, <=1.2.0) +35 more potentially affected by CVE-2023-33201 via org.bouncycastle:bcprov-debug-jdk15on (>=1.53, <=1.70)

org.bouncycastle:bcprov-debug-jdk15on MAVEN version =1.53, =1.1.0, =1.1.0, =0.8.635, =0.8.635, =0.8.635, =0.8.635, =0.0.1, =4.4.0, =1.3.8, =1.3.7, =1.3.7, =1.3.8, =1.4.0 - de.ohmesoftware:keytool 0.0.2 and more Source cves: CVE-2023-33201 Source advisory: OSV:GHSA-HR8G-6V94-X4M9...

org.apache.camel.quarkus:camel-quarkus-as2 (>=3.0.0-m1, <=3.0.0-m2), org.apache.camel.quarkus:camel-quarkus-as2-deployment (>=3.0.0-m1, <=3.0.0-m2) +3 more potentially affected by CVE-2023-33201 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.72)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =3.0.0-m1, =3.0.0-m1, =3.18.0, =3.18.0, =3.18.0, =4.0.0-m3 Source cves: CVE-2023-33201 Source advisory: GHSA-HR8G-6V94-X4M9...

com.github.mizosoft.methanol:benchmarks (>=1.1.0, <=1.2.0), com.github.mizosoft.methanol:methanol-testutils (>=1.1.0, <=1.2.0) +35 more potentially affected by CVE-2023-33201 via org.bouncycastle:bcprov-debug-jdk15on (>=1.53, <=1.70)

org.bouncycastle:bcprov-debug-jdk15on MAVEN version =1.53, =1.1.0, =1.1.0, =0.8.635, =0.8.635, =0.8.635, =0.8.635, =0.0.1, =4.4.0, =1.3.8, =1.3.7, =1.3.7, =1.3.8, =1.4.0 - de.ohmesoftware:keytool 0.0.2 and more Source cves: CVE-2023-33201 Source advisory: GHSA-HR8G-6V94-X4M9...

org.apache.camel.quarkus:camel-quarkus-as2 (>=3.0.0-m1, <=3.0.0-m2), org.apache.camel.quarkus:camel-quarkus-as2-deployment (>=3.0.0-m1, <=3.0.0-m2) +3 more potentially affected by CVE-2023-33201 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.72)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =3.0.0-m1, =3.0.0-m1, =3.18.0, =3.18.0, =3.18.0, =4.0.0-m3 Source cves: CVE-2023-33201 Source advisory: OSV:GHSA-HR8G-6V94-X4M9...

org.apache.camel.quarkus:camel-quarkus-as2 (>=3.0.0-m1, <=3.0.0-m2), org.apache.camel.quarkus:camel-quarkus-as2-deployment (>=3.0.0-m1, <=3.0.0-m2) +3 more potentially affected by CVE-2023-33201 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.72)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =3.0.0-m1, =3.0.0-m1, =3.18.0, =3.18.0, =3.18.0, =4.0.0-m3 Source cves: CVE-2023-33201 Source advisory: MEND:CVE-2023-33201...

VulnCheck KEV: CVE-2010-1573

Linksys WAP54Gv3 firmware 3.04.03 and earlier uses a hard-coded username Gemtek and password gemtekswd for a debug interface for certain web pages, which allows remote attackers to execute arbitrary commands via the 1 data1, 2 data2, or 3 data3 parameters to a Debugcommandpage.asp and b debug.cgi...

Format string

CometBFT is a Byzantine Fault Tolerant BFT middleware that takes a state transition machine and replicates it on many machines. An internal modification made in versions 0.34.28 and 0.37.1 to the way struct PeerState is serialized to JSON introduced a deadlock when new function MarshallJSON is...