Nullsoft Scriptable Install System Privilege Escalation

The vulnerability of the Nullsoft Scriptable Install System development system is related to lack of access control mechanisms. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

Google Chrome Extensions API

The vulnerability of the Google Chrome browser’s Extensions API is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to install any extension through a specially created HTML page...

Google Chrome Extensions API

The vulnerability of the Google Chrome browser’s Extensions API relates to the use of memory after it is freed. Exploiting this vulnerability could allow a malicious actor to install any extension using a specially created HTML page...

Fedora: Security Advisory for trafficserver (FEDORA-2023-dcbfbf1396)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-39115

install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document...

PT-2023-26790

Name of the Vulnerable Software and Affected Versions Campcodes Online Matrimonial Website System Script version 3.3 Description The issue allows for XSS via a crafted SVG document. This is possible through the "install/aiz-uploader/upload" endpoint. Recommendations For version 3.3, consider...

CVE-2023-39115: Unrestricted Upload of File with Dangerous Type

install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document...

CVE-2023-28479

An issue was discovered in Tigergraph Enterprise 3.7.0. The TigerGraph platform installs a full development toolchain within every TigerGraph deployment. An attacker is able to compile new executables on each Tigergraph system and modify system and Tigergraph binaries...

Gigabud RAT Android Banking Malware Targets Institutions Across Countries

Account holders of over numerous financial institutions in Thailand, Indonesia, Vietnam, the Philippines, and Peru are being targeted by an Android banking malware called Gigabud RAT. "One of Gigabud RAT's unique features is that it doesn't execute any malicious actions until the user is authoriz...

KLA52323 Multiple vulnerabilities in Microsoft Office

A spoofing vulnerability was found in Microsoft Office. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2023-36769 Exploitation Public exploits exist for this vulnerability. Related products Microsoft-Office CVE list CVE-2023-36769 high KB list...

Google Chrome security vulnerabilities

Google Chrome is a web browser from Google Inc. in the United States. A security vulnerability exists in Google Chrome prior to version 116.0.5845.96, which stems from an inadequate enforcement of Extensions API policies, allowing remote attackers to bypass corporate policies via a crafted HTML...

Ubuntu: Security Advisory (USN-6278-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MAL-2023-8365 Malicious code in python-aliyun-sdk-ecs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx fcb822b0528f2cbde54bd2197ed8c774dda8cafc7c3e9ae5aff56465e7c6c72c Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

GHSA-VMCH-3W2X-VHGQ .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2023-38180: .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1, .NET 6.0, and .NET 7.0. This advisory also provides guidance on what developers can do...

CVE-2023-4243

The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing...

WordPress plugin FULL - Customer code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin FULL - Customer A...

CVE-2023-4243: Improper Authorization

The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing...

Vulnerability fixed in Microsoft SQL Server

Microsoft has fixed a vulnerability in OLEDB, a component used by clients to communicate with SQL Server. A malicious party could exploit the vulnerability to execute arbitrary execute arbitrary code on the client using OLEDB. The malicious party must trick the victim into contacting a rogue SQL...

VulnCheck KEV: CVE-2023-4243

The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing...

PT-2023-28336 · WordPress · Full - Customer

Name of the Vulnerable Software and Affected Versions: The FULL - Customer plugin for WordPress versions up to, and including, 2.2.3 Description: The issue allows authenticated attackers with subscriber-level permissions and above to execute code by installing plugins from arbitrary remote...