Cross site scripting

Stored cross-site scripting vulnerability exists in the App Settings /admin/app page, the Markdown Settings /admin/markdown page, and the Customize /admin/customize page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser o...

CVE-2023-49807

Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-49119

Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-49119

Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-45740

Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

Apache Pulsar WebSocket Proxy Denial of Service Vulnerability

Apache Pulsar is a U.S. Apache Apache Foundation for cloud environments, set of messages, storage, lightweight functional computing as a distributed message flow platform. A denial of service vulnerability exists in Apache Pulsar WebSocket Proxy, which can be exploited by an attacker to cause a...

How does ThreatDown Vulnerability Assessment and Patch Management work?

Maintaining updated systems and applications is a challenge for any IT team—especially considering the sheer volume of vulnerabilities organizations must find and prioritize on a rolling basis. ThreatDown Vulnerability Assessment VA, now included for free in every ThreatDown bundle, simplifies th...

Urgent: New Chrome Zero-Day Vulnerability Exploited in the Wild - Update ASAP

Google has rolled out security updates for the Chrome web browser to address a high-severity zero-day flaw that it said has been exploited in the wild. The vulnerability, assigned the CVE identifier CVE-2023-7024, has been described as a heap-based buffer overflow bug in the WebRTC framework that...

WordPress Clockwork SMS Notfications Plugin <= 3.0.4 is vulnerable to SQL Injection

Software Clockwork SMS Notfications Type Plugin Vulnerable versions = 3.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-50843 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 56466c20b5e4 Credits Mika Required privilege Administrator...

Google Chrome Security Update (stable-channel-update-for-desktop_20-2023-12) - Windows

Google Chrome is prone to a heap buffer overflow vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

CVE-2020-12124

creationtimestamp| type| source ---|---|--- 2023-12-20 15:42:28+00:00| seen| https://t.me/arpsyndicate/2042 2025-03-23 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2025-03-23 2025-04-19 00:00:00+00:00| exploited| The Shadowserver...

Google Chrome < 120.0.6099.129 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 120.0.6099.129. It is, therefore, affected by a vulnerability as referenced in the 202312stable-channel-update-for-desktop20 advisory. - Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a...

ABO.CMS Security Vulnerabilities

ABO.CMS is a content management platform. A security vulnerability exists in ABO.CMS. An attacker exploited the vulnerability to perform a SQL injection attack...

2023 Threat Landscape Year in Review: If Everything Is Critical, Nothing Is

As 2023 nears its end, its time to pause and reflect. It’s time to assess what worked and what didnt, what caught our attention and caused disruption, and what went unnoticed. More importantly, we need to know what lessons we learned from 2023 so that we can do a better job of managing risk in th...

Attacks, Vulnerabilities and Actors 11 December to 17 December 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of eleven executed attacks, six instances of adversary activity, and five exploited...

PT-2023-7984 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 120.0.6099.129 Description: A heap buffer overflow in WebRTC allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability is actively exploited and may cause crashe...

Design/Logic Flaw

A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to use less secure communication protocols. This issue affects: Gallagher Diagnostics Service prior to v1.3.0 distributed in 9.00.1507MR1...

Dell Virtual Appliance Manager Arbitrary File Read Vulnerability (CNVD-2024-0018759)

Dell Virtual Appliance Manager is a virtual appliance manager from Dell USA. An arbitrary file read vulnerability exists in Dell Virtual Appliance Manager, which can be exploited by an attacker to read arbitrary files from the target system...

Dell Virtual Appliance Manager Command Injection Vulnerability (CNVD-2024-0018660)

Dell Virtual Appliance Manager is a virtual appliance manager from Dell USA. A command injection vulnerability exists in Dell Virtual Appliance Manager, which can be exploited by an attacker to cause arbitrary operating system commands to be executed on an affected system...

Dell Virtual Appliance Manager Command Injection Vulnerability (CNVD-2024-0018561)

Dell Virtual Appliance Manager is a virtual appliance manager from Dell USA. A command injection vulnerability exists in Dell Virtual Appliance Manager, which can be exploited by an attacker to cause arbitrary operating system commands to be executed on an affected system...