1728 matches found
CVE-2023-43123
On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method...
Design/Logic Flaw
On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method...
CVE-2023-43123 Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files
On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method...
CVE-2023-43123
CVE-2023-43123 affects Apache Storm (Storm-core) on Unix-like systems where a shared temporary directory can allow other local users to read sensitive data written by temp files created via File.createTempFile (permissions -rw-r--r-- by default). The issue is triggered when the system property 'j...
CVE-2023-43123 Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files
On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method...
Why Defenders Should Embrace a Hacker Mindset
Today's security leaders must manage a constantly evolving attack surface and a dynamic threat environment due to interconnected devices, cloud services, IoT technologies, and hybrid work environments. Adversaries are constantly introducing new attack techniques, and not all companies have intern...
Oracle Linux 9 : cups (ELSA-2023-6596)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6596 advisory. - CVE-2023-32360 cups: Information leak through Cups-Get-Document operation - CVE-2023-34241 cups: use-after-free in cupsdAcceptClient in...
WordPress WP Like Button Plugin <= 1.7.0 is vulnerable to Broken Access Control
Software WP Like Button Type Plugin Vulnerable versions = 1.7.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47820 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6a5c3f8c76dc Credits Abdi Pranata Required privilege...
CVE-2023-4888
CVE-2023-4888 affects the Simple Like Page Plugin for WordPress (v ≤ 1.5.1). It enables Stored Cross-Site Scripting via the sfp-page-plugin shortcode, allowing authenticated attackers with contributor-level permissions to inject scripts that execute in pages viewed by users. The advisory consolid...
WordPress Plugin Simple Like Page Plugin Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
WordPress Simple Like Page Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)
Software Simple Like Page Type Plugin Vulnerable versions = 1.5.1 Fixed in 1.5.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4888 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b392da079bc2 Credits Lana Codes Required...
RHEL 9 : cups (RHSA-2023:6596)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6596 advisory. The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: cups...
Rocky Linux 8 : Satellite 6.11 Release (Moderate) (RLSA-2022:5498)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5498 advisory. - Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol serve...
DEBIAN-CVE-2023-43622
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in...
Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Samba vulnerabilities (USN-6425-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6425-1 advisory. Sri Nagasubramanian discovered that the Samba aclxattr VFS module incorrectly handled read-only files. When Samba is configured to...
The vulnerability of the restoreSettings function in the Comments Like Dislike plugin of the WordPress content management system allows a hacker to compromise the integrity of the data.
The vulnerability of the restoreSettings function in the WordPress content management system’s comments and dislikes module is related to authentication errors. Exploiting this vulnerability could allow an attacker to compromise data integrity...
CVE-2023-41650
Cross-Site Request Forgery CSRF vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin = 2.1 versions...
CVE-2023-41650
CVE-2023-41650 describes a CSRF vulnerability in the WordPress plugin Remove/hide Author, Date, Category Like Entry-Meta (versions