CVE-2023-3485 Insecure Default Authorization in Temporal Server

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

encyclopedia.chicagohistory.org Cross Site Scripting vulnerability OBB-3477218

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security feature bypass

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrade contains a fix for a bug in a document, just a new version of that document is added. In some cases, it's still possible to exploit the...

CVE-2023-36468 Upgrading doesn't prevent exploiting vulnerable XWiki documents

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrade contains a fix for a bug in a document, just a new version of that document is added. In some cases, it's still possible to exploit the...

CVE-2023-36468 Upgrading doesn't prevent exploiting vulnerable XWiki documents

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrade contains a fix for a bug in a document, just a new version of that document is added. In some cases, it's still possible to exploit the...

CVE-2023-36468

CVE-2023-36468 affects XWiki Platform. The advisory describes that upgrading to a fixed version does not always prevent exploitation: appending rev=1.1 to the reproduction URL can still trigger remote code execution despite patches. Patches exist in XWiki 14.10.7 and 15.2RC1, which force old revi...

The Night 17 Million Precious Military Records Went Up in Smoke

Fifty years ago, a fire ripped through the National Personnel Records Center. It set off a massive project to save crucial pieces of American history—including, I hoped, my grandfather’s...

Rocket LMS 1.7 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

CVE-2023-30945

Multiple Services such as VHSVideo History Server and VCDVideo Clip Distributor and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker could read sensitive files from the filesyst...

CVE-2023-30945 CVE-2023-30945

Multiple Services such as VHSVideo History Server and VCDVideo Clip Distributor and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker could read sensitive files from the filesyst...

PT-2023-23076 · Vcd +2 · Vcd +2

Name of the Vulnerable Software and Affected Versions: Multiple Services versions affected versions not specified Description: The issue is related to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. This allows a malicious attacker to read...

部分Palantir产品 路径遍历漏洞

Palantir is a data platform from US-based Palantir that reimagines how people use data by removing the barriers between back-end data management and front-end data analysis. A security vulnerability exists in some Palantir products, which stems from a vulnerability that allows an attacker to read...

CVE-2023-3388

The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nscbarcontenthref' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Security and Human Behavior (SHB) 2023

Im just back from the sixteenth Workshop on Security and Human Behavior, hosted by Alessandro Acquisti at Carnegie Mellon University in Pittsburgh. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of security, organized each year by Alessandro...

fossbilling 安全漏洞

fossbilling is a free open source solution for efficient billing and customer management. A security vulnerability exists in fossbilling versions prior to 0.5.0 that stems from a lack of authorization...

CVE-2023-33621

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay...

Authentication flaw

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay...

CVE-2023-34026

Unauth. Reflected Cross-Site Scripting XSS vulnerability in BrokenCrust This Day In History plugin = 3.10.1 versions...

CVE-2023-34026

Unauth. Reflected Cross-Site Scripting XSS vulnerability in BrokenCrust This Day In History plugin = 3.10.1 versions...

Tracing the Path: Unraveling the Full History of Toncoin

By Owais Sultan Join us on this captivating journey as we uncover the remarkable story behind Toncoin, a non-custodial cryptocurrency wallet,… This is a post from HackRead.com Read the original post: Tracing the Path: Unraveling the Full History of Toncoin...