Authorization

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...

CVE-2023-40610 Apache Superset: Privilege escalation with default examples database

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...

PT-2023-27540

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to but excluding 2.1.2 Description The issue is related to an improper authorization check, which could lead to possible privilege escalation. Using the default examples database connection, an attacker could access...

RHEL 8 : qt5-qtsvg (RHSA-2023:6961)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6961 advisory. Scalable Vector Graphics SVG is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displayin...

VulnCheck KEV: CVE-2022-34305

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

HBSQLI - Automated Tool For Testing Header Based Blind SQL Injection

HBSQLI is an automated command-line tool for performing Header Based Blind SQL injection attacks on web applications. It automates the process of detecting Header Based Blind SQL injection vulnerabilities, making it easier for security researchers , penetration testers & bug bounty hunters to tes...

Wallarm Webinar: NIST CSF 2.0, API Security, and CISO Imperatives

Last week, our good friend Raj Umadas, Director of Security at ActBlue, teamed up with our very own Tim Erlin, Head of Product, to talk about the newly proposed NIST Cybersecurity Framework CSF. It was a fantastic discussion covering the intent behind this update, the major changes from v1.1 to...

org.drools.planner:drools-planner-core (5.4.0.beta2), org.drools.planner:drools-planner-distribution (5.4.0.beta2) +23 more potentially affected by CVE-2022-1415 via org.drools:drools-core (5.4.0.beta2)

org.drools:drools-core MAVEN version 5.4.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.4.0.beta2 - org.drools.planner:drools-planner-distribution 5.4.0.bet...

DRUPAL-CONTRIB-2023-041

This module makes PatternLab's custom Twig functions available to Drupal theming. The module's included examples don't sufficiently filter data. This vulnerability is mitigated by the fact that the included examples must have been copied to a site's theme...

dbnd-examples (>=0.50.1, <=0.56.7), earnest-airflow-plugin (>=0.0.1, <=0.0.2b1) +1 more potentially affected by CVE-2023-39508 via apache-airflow (1.10.10)

apache-airflow PYPI version 1.10.10 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-examples =0.50.1, =0.0.1, =10.3.0rc1, =10.3.0rc2 Source cves: CVE-2023-39508 Source advisory: OSV:GHSA-269X-PG5C-5XGM...

dbnd-examples (>=0.50.1, <=0.56.7), earnest-airflow-plugin (>=0.0.1, <=0.0.2b1) +1 more potentially affected by CVE-2023-39508 via apache-airflow (1.10.10)

apache-airflow PYPI version 1.10.10 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-examples =0.50.1, =0.0.1, =10.3.0rc1, =10.3.0rc2 Source cves: CVE-2023-39508 Source advisory: OSV:PYSEC-2023-134...

com.github.brandtg:dropwizard-helix (0.0.1), org.apache.helix:helix-examples (0.7.1) +2 more potentially affected by CVE-2023-38647 via org.apache.helix:helix-core (0.7.1)

org.apache.helix:helix-core MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.helix:helix-core and may be impacted: - com.github.brandtg:dropwizard-helix 0.0.1 - org.apache.helix:helix-examples 0.7.1 -...

dbnd-examples (>=0.50.1, <=0.56.7), earnest-airflow-plugin (>=0.0.1, <=0.0.2b1) +1 more potentially affected by CVE-2023-22888 via apache-airflow (1.10.10)

apache-airflow PYPI version 1.10.10 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-examples =0.50.1, =0.0.1, =10.3.0rc1, =10.3.0rc2 Source cves: CVE-2023-22888 Source advisory: OSV:GHSA-5946-8P38-VFFP...

dbnd-examples (>=0.50.1, <=0.56.7), earnest-airflow-plugin (>=0.0.1, <=0.0.2b1) +1 more potentially affected by CVE-2023-22888 via apache-airflow (1.10.10)

apache-airflow PYPI version 1.10.10 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-examples =0.50.1, =0.0.1, =10.3.0rc1, =10.3.0rc2 Source cves: CVE-2023-22888 Source advisory: OSV:PYSEC-2023-105...

org.eclipse.jetty:jetty-annotations (7.0.0.m0), org.eclipse.jetty:jetty-deploy (7.0.0.m0) +8 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.0.0.m0)

org.eclipse.jetty:jetty-xml MAVEN version 7.0.0.m0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty:jetty-annotations 7.0.0.m0 - org.eclipse.jetty:jetty-deploy 7.0.0.m0 -...

org.eclipse.jetty:jetty-annotations (7.0.0.m1), org.eclipse.jetty:jetty-deploy (7.0.0.m1) +10 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.0.0.m1)

org.eclipse.jetty:jetty-xml MAVEN version 7.0.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.eclipse.jetty:jetty-annotations 7.0.0.m1 - org.eclipse.jetty:jetty-deploy 7.0.0.m1 -...

org.apache.inlong:manager-client (>=1.4.0, <=1.6.0), org.apache.inlong:manager-client-examples (>=1.4.0, <=1.6.0) +2 more potentially affected by CVE-2023-31058 via org.apache.inlong:manager-common (>=1.4.0, <=1.6.0)

org.apache.inlong:manager-common MAVEN version =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.6.0 Source cves: CVE-2023-31058 Source advisory: OSV:GHSA-C3RH-F2W5-FGHM...

org.apache.inlong:manager-client (>=1.4.0, <=1.6.0), org.apache.inlong:manager-client-examples (>=1.4.0, <=1.6.0) +1 more potentially affected by CVE-2023-31058 via org.apache.inlong:manager-pojo (>=1.4.0, <=1.6.0)

org.apache.inlong:manager-pojo MAVEN version =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.6.0 Source cves: CVE-2023-31058 Source advisory: GHSA-C3RH-F2W5-FGHM...

Microsoft Windows PowerShell Remote Command Execution Exploit

This python script mints a .ps1 file with an exploitable semicolon condition that allows for command execution from Microsoft Windows PowerShell. This is an updated exploit to work with Python3. from base64 import b64encode import argparse,sys,os PSTrojanFile.py By hyp3rlinx c 2023 ApparitionSec...

openSUSE 15 Security Update : qt6-svg (openSUSE-SU-2023:0111-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0111-1 advisory. - In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont munitsPerEm initialization is mishandled...