MAL-2022-7090 Malicious code in webbluetooth-edison-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 584e358581bfe311bfd1bb428724c5cdaefe6f28189d3e64422d4b628c5f6e6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Path Traversal in Zimbra Collaboration

CVE-2022-41352 Zimbra Unauthenticated RCE CVE-2022-41352...

WordPress PostmagThemes Demo plugin <= 1.0.7 - Auth. Arbitrary File Upload vulnerability

Auth. Arbitrary File Upload vulnerability discovered by thunder.god.hhh in WordPress PostmagThemes Demo plugin versions = 1.0.7. Solution Deactivate and delete. This plugin has been closed as of November 10, 2022 and is not available for download. This closure is temporary, pending a full review...

PostmagThemes Demo < 1.0.8 - Admin+ Arbitrary File Upload

The plugin does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files such as PHP leading to RCE. 1. Go to Appearance » Import Demo Data » Manual demo files upload » Run "Choose a JSON file for customizer import" and import a PHP file. 2. Click Impo...

NGWAF - First Iteration Of ML Based Feedback WAF

The Motivation | What is the N3XT ST3P? With the explosive growth of web applications since the early 2000s, web-based attacks have progressively become more rampant. One common solution is the Web Application Firewall WAF. However, tweaking rules of current WAFs to improve the detection mechanis...

Theme-Demo-Importer < 1.1.1 - Admin+ Arbitrary File Upload

The plugin does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files such as PHP even when FILEMODS and FILEEDIT are disallowed. PoC 1. Navigate to: Appearance Import Demo Content Theme Demo Importer Manually upload the demo files 2. Use the XML...

Theme-Demo-Importer < 1.1.1 - Admin+ Arbitrary File Upload

The plugin does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files such as PHP even when FILEMODS and FILEEDIT are disallowed. 1. Navigate to: Appearance Import Demo Content Theme Demo Importer Manually upload the demo files 2. Use the XML file...

Forma SPOT-LMS 3.2.1 Cross Site Scripting

Title: Forma SPOT-LMS-3.2.1 Cross-site scripting reflected RCE - reset mail vulnerability Author: nu11secur1ty Date: 11.07.2022 Vendor: https://www.spotlms.us/indexmulti.php The software is applied in the demo account: https://www.spotlms-anca-001.ovh/ Reference:...

Exploit for Authorization Bypass Through User-Controlled Key in Vmware Spring_Security

CVE-2022-31692 Demo Overview A simple Spring Boot applicat...

MAL-2022-1475 Malicious code in bc-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1d5617c26015681699f77459a3f1a44a8b19f0dcf78ed8228fc81852afb9a78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bc-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1d5617c26015681699f77459a3f1a44a8b19f0dcf78ed8228fc81852afb9a78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-24934 · Qtiworks · Qtiworks

Name of the Vulnerable Software and Affected Versions: QTIWorks versions prior to 1.0-beta15 Description: QTIWorks is a software suite for standards-based assessment delivery. The ZIP handling code does not sufficiently check the paths of files contained within ZIP files, allowing files to be...

Exploit for Code Injection in Apache Commons_Text

CVE-2022-42889 Test application This repository contains a si...

Joomla Rentalot Plus 19.05 Cross Site Scripting Vulnerability

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ Exploits ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : extensions.joomla.org │ │ Vendor : Les Arbres Design │ │ Software :...

Joomla DJ-Classifieds Ads 3.9 Cross Site Scripting Vulnerability

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ Exploits ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : extensions.joomla.org │ │ Vendor : DJ-Extensions │ │ Software :...

Rdiffweb 安全漏洞

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. Provides quick access to your archives through an efficient web interface. A denial of service vulnerability exists in Rdiffweb versions prior to 2.4.8, which stems from a lack of length validation of the root...

What’s New for Developers: September 2022

Learn about Akamai’s voxel art contest, the updates to EdgeWorkers and EdgeKV demo sites, and how the beta Test Center CLI allows you to test the behavior of configuration changes on your own in this month’s blog...

CVE-2022-37700

Zentao Demo15 is vulnerable to Directory Traversal. The impact is: obtain sensitive information remote. The component is: URL : view-source:https://demo15.zentao.pm/user-login.html/zentao/index.php?mode=getconfig...

Malicious Package

Overview workers-chat-demo is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Password can be set extremely weak

Description In this scenario, I use the demo website. It allows us to add more user to test. With password, we can set it 1 Or any charater. There is no policy for password or no password checking. Moreover, it also allows us to change password and the new password also can be set with password...