AVIator - Antivirus Evasion Project

AviAtor Ported to NETCore 5 with an updated UI AV|Ator About ://name AV : AntiVirus Ator : Is a swordsman, alchemist, scientist, magician, scholar, and engineer, with the ability to sometimes produce objects out of thin air https://en.wikipedia.org/wiki/Ator About ://purpose AV|Ator is a backdoor...

CVE-2022-46761

The system has a vulnerability that may cause dynamic hiding and restoring of app icons.Successful exploitation of this vulnerability may cause malicious hiding of app icons...

HUAWEI EMUI/Magic UI 安全漏洞

Huawei EMUI is a mobile operating system developed based on Android.Huawei HarmonyOS is to provide a full-scenario distributed operating system based on microkernel. A security bypass vulnerability exists in Huawei EMUI and HarmonyOS.The vulnerability is caused due to dynamic hiding and restoring...

Icon Widget < 1.3.0 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Exploit:...

Icon Widget < 1.3.0 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC Exploit:...

WordPress Icon Widget Plugin < 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Icon Widget Type Plugin Vulnerable versions 1.3.0 Fixed in 1.3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4763 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 818cb8e834a0 Credits István Márton Required...

Sassy Social Share < 3.3.45 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Insert the...

laZzzy - Shellcode Loader, Developed Using Different Open-Source Libraries, That Demonstrates Different Execution Techniques

laZzzy is a shellcode loader that demonstrates different execution techniques commonly employed by malware. laZzzy was developed using different open-source header-only libraries. Features Direct syscalls and native Nt functions not all functions but most Import Address Table IAT evasion Encrypte...

CVE-2022-4601 Shoplazza LifeStyle Shipping/Member Discount/Icon cross site scripting

A vulnerability was found in Shoplazza LifeStyle 1.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/api/theme-edit/ of the component Shipping/Member Discount/Icon. The manipulation leads to cross site scripting. The attack can be initiated remotel...

Malicious code in icon-ionicon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa19b67c8ff05aac2b44239a9c86194d95b309b5e531b0704b9e4883ecb52be4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3750 Malicious code in icon-ionicon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa19b67c8ff05aac2b44239a9c86194d95b309b5e531b0704b9e4883ecb52be4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3751 Malicious code in icon-ionicons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3ea0dd0a77658f88ec68d9fe8b13765b6debe58e5a5bb0aa726f11c8d08d42e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in icon-ionicons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3ea0dd0a77658f88ec68d9fe8b13765b6debe58e5a5bb0aa726f11c8d08d42e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-41931

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection'. Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper...

CVE-2022-41931 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection'. Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper...

CVE-2022-41931 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection'. Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper...

CVE-2022-41931

CVE-2022-41931 affects xwiki-platform-icon-ui. It enables Eval Injection through the iconPicker macro, allowing an authenticated user with view rights on common documents to run arbitrary Groovy/Python/Velocity code due to improper neutralization of macro parameters. The vulnerability is fixed in...

XWiki Platform 安全漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from XWiki France. A security vulnerability exists in XWiki Platform xwiki-platform-icon-ui, which stems from improper instruction neutralization...

CVE-2022-41931 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection'. Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper...

SUSE-SU-2022:4080-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: - Update to jdk-11.0.17+8 October 2022 CPU - CVE-2022-39399: Improve HTTP/2 client usagebsc1204480 - CVE-2022-21628: Better HttpServer service bsc1204472 - CVE-2022-21624: Enhance icon presentations bsc1204475 - CVE-2022-21619: Improve...