4870 matches found
Malicious code in mennort (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a18b704aee3dd3fa8d54027bbe2d6634696fcffaf194410e38fb5318d0d2a534 Package sends out the data to a hardcoded webhook. However, it's clearly said in the description, thus - not really malicious. --- Category: PROBABLYPENTEST -...
Fedora 40 : python3.8 (2024-6dedbc5cf9)
The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-6dedbc5cf9 advisory. This is a security release of Python 3.11 ----------------------------------------- Note: The release you're looking at is Python 3.11.10, a securit...
Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...
WordPress Limit Login Attempts Plus plugin <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass vulnerability
IP Address Spoofing to Protection Mechanism Bypass vulnerability discovered by rezaduty in WordPress Plugin Limit Login Attempts Plus versions = 1.1.0...
CVE-2022-4533
The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
CVE-2022-4533 Limit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass
The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
CVE-2022-4533 Limit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass
The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
CVE-2022-4533
CVE-2022-4533 affects the WordPress plugin Limit Login Attempts Plus up to version 1.1.0. The vulnerability stems from insufficient restrictions on where the IP Address is retrieved for request logging and login restrictions, allowing an attacker to spoof the IP via the X-Forwarded-For header and...
CVE-2022-4533: Use of Less Trusted Source
The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
HYSCALE System 1.9 Add Administrator / Cross Site Request Forgery
============================================================================================================================================= | Title : HYSCALE System v1.9 CSRF add admin Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64...
ROS-20240917-08
Vulnerability of classes ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address and ipaddress.IPv6Network of the ipaddress module of the Python programming language interpreter CPython is related to the incorrect IP address range validation. Exploitation of the vulnerability could...
CVE-2024-43099
The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into a...
CVE-2024-43099 AutomationDirect DirectLogic H2-DM1E Authentication Bypass by Capture-replay
The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into a...
CVE-2024-43099
CVE-2024-43099 affects AutomationDirect DirectLogic H2-DM1E PLCs (versions ≤2.8.0). The vulnerability enables authentication bypass by capture-replay, allowing an attacker who captures a session key and spoofs IP/MAC to inject traffic into an ongoing authenticated session. Affected product is the...
CVE-2024-43099 AutomationDirect DirectLogic H2-DM1E Authentication Bypass by Capture-replay
The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into a...
New Linux Malware Campaign Exploits Oracle Weblogic to Mine Cryptocurrency
Cybersecurity researchers have uncovered a new malware campaign targeting Linux environments to conduct illicit cryptocurrency mining and deliver botnet malware. The activity, which specifically singles out the Oracle Weblogic server, is designed to deliver a malware strain dubbed Hadooken,...
CVE-2024-8751
A vulnerability allows a remote unauthenticated attacker to modify the prod uct’s IP address over the Sopas ET interface. This can lead to a Denial of Service attack...
CVE-2024-8751
The CVE-2024-8751 entry concerns SICK MSC800 (and MSC800 LFT) with a vulnerability that allows an unauthenticated attacker to modify the device IP via Sopas ET, potentially causing a Denial of Service. Affected versions are MSC800 prior to V4.26 and MSC800 LFT prior to S2.93.20. Remediation is to...