Metasploit Weekly Wrap-Up

Flask Cookies This week includes two modules related to Flask cookie signatures. One is specific to Apache Superset where session cookies can be resigned, allowing an attacker to elevate their privileges and dump the database connection strings. While adding this functionality, community member...

GHSA-PWH8-58VV-VW48 vulnerabilities

Vulnerabilities for packages: cloudwatch-exporter...

GHSA-PWH8-58VV-VW48 vulnerabilities

Vulnerabilities for packages: cloudwatch-exporter...

GHSA-HMR7-M48G-48F6 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, druid, cloudwatch-exporter, spark...

GHSA-HMR7-M48G-48F6 vulnerabilities

Vulnerabilities for packages: cloudwatch-exporter, druid, cassandra-reaper...

GHSA-3GH6-V5V9-6V9J vulnerabilities

Vulnerabilities for packages: cloudwatch-exporter, cassandra-reaper...

GHSA-3GH6-V5V9-6V9J vulnerabilities

Vulnerabilities for packages: cassandra-reaper, cloudwatch-exporter, apache-hop-fips, apache-hop...

Prometheus Node Exporter And Windows Exporter Information Gather

This modules connects to a Prometheus Node Exporter or Windows Exporter service and gathers information about the host. Tested against Docker image 1.6.1, Linux 1.6.1, and Windows 0.23.1 Module Options msf use auxiliary/gather/prometheusnodeexportergather msf auxiliaryprometheusnodeexportergather...

CVE-2023-30871

Unauth. Reflected Cross-Site Scripting XSS vulnerability in PT Woo Plugins by Webdados Stock Exporter for WooCommerce plugin = 1.1.0 versions...

CVE-2023-30871 WordPress Stock Exporter for WooCommerce Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in PT Woo Plugins by Webdados Stock Exporter for WooCommerce plugin = 1.1.0 versions...

CVE-2023-30871

CVE-2023-30871 affects the WordPress plugin Stock Exporter for WooCommerce by PT Woo Plugins (by Webdados). On versions = 1.2.0. If upgrading immediately is not possible, apply vendor-supplied mitigations/patches where available and ensure input/output handling adheres to secure coding practices....

WordPress plugin Stock Exporter for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

SUSE-SU-2023:3144-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: python-tornado: - Security fixes: CVE-2023-28370: Fixed an open redirect issue in the static file handler bsc1211741 prometheus-blackboxexporter: - Use obscpio for go modules service - Set version number - Set build date from SOURCEDATEEPOCH - Update to...

SUSE-SU-2023:3122-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: python-tornado: - Security fixes: CVE-2023-28370: Fixed an open redirect issue in the static file handler bsc1211741 kiwi-desc-saltboot: - Update to version 0.1.1687520761.cefb248 Add osimage cert package to bootstrap for SUSE Linux Enterprise 12 images...

WordPress Market Exporter Plugin <= 2.0.18 is vulnerable to Cross Site Scripting (XSS)

Software Market Exporter Type Plugin Vulnerable versions = 2.0.18 Fixed in 2.0.19 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 8f5b74a99cbb Credits Rafie Muhammad Patchstack Required...

Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats.

Impact A Cross-Site Scripting XSS vulnerability was found in the HTML output of chats. XSS is intended to be mitigated by Jinja's escape function. However, autoescape=True was missing when setting the environment. Although the actual impact is low, considering the HTML file is being viewed offlin...

PT-2023-32997 · Unknown · Whatsapp-Chat-Exporter

Name of the Vulnerable Software and Affected Versions: WhatsApp-Chat-Exporter versions prior to 0.9.5 Description: A Cross-Site Scripting XSS issue was discovered in the HTML output of chats, due to the absence of autoescape=True when setting the environment, which is intended to be mitigated by...

SUSE-SU-2023:2798-1 Security update for prometheus-sap_host_exporter

This update for prometheus-saphostexporter fixes the following issues: - rebuild the package with the go 1.20 security release bsc1208270. - fixed exporter package description bsc1211311...

PT-2023-36219 · Unknown · Prometheus-Sap Host Exporter

Name of the Vulnerable Software and Affected Versions: prometheus-sap host exporter affected versions not specified Description: The issue is related to the prometheus-sap host exporter package, which has been rebuilt with the go 1.20 security release. Additionally, the exporter package descripti...

PT-2023-36214 · Unknown · Prometheus-Sap Host Exporter

Name of the Vulnerable Software and Affected Versions: prometheus-sap host exporter affected versions not specified Description: The issue concerns a security update for prometheus-sap host exporter, which includes a rebuild of the package with the go 1.20 security release. Additionally, the...