CVE-2023-31407

SAP Business Planning and Consolidation - versions 740, 750, allows an authorized attacker to upload a malicious file, resulting in Cross-Site Scripting vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application...

Input validation

Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited...

Moodle SQL注入漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a security vulnerability that stems from insufficient cleansing of user-supplied data in an external Wiki method us...

LimeRAT Malware Analysis: Extracting the Config

Remote Access Trojans RATs have taken the third leading position in ANY. RUN's Q1 2023 report on the most prevalent malware types, making it highly probable that your organization may face this threat. Though LimeRAT might not be the most well-known RAT family, its versatility is what sets it...

The Anatomy of a Scalping Bot: NSB Was Copped!

In recent years, scalping bots have become a growing concern for online retailers. In this two-part blog series, we will analyze the inner workings of the Nike Shoe Bot NSB scalping bot, one of the most dangerous scalping bots around. We will take a closer look at the components of NSB, how we...

CVE-2022-45074

Cross-Site Request Forgery CSRF vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin = 1.0.22 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin = 1.0.22 versions...

CVE-2022-45074 WordPress Activity Reactions For Buddypress Plugin <= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin = 1.0.22 versions...

CVE-2022-45074

CVE-2022-45074 refers to a CSRF vulnerability in the WordPress Activity Reactions for Buddypress plugin (versions

CVE-2022-45074 WordPress Activity Reactions For Buddypress Plugin <= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin = 1.0.22 versions...

barbican 安全漏洞

barbican is an OpenStack key management service, API server. A security vulnerability exists in barbican that stems from a container isolation flaw in Red Hat OpenStack that allows an attacker to have limited authentication and access to the Barbican container, potentially allowing access to othe...

The vulnerability of the SGIUtility component in the HMI terminal configuration software for Schneider Electric EcoStruxure Operator Terminal Expert and the SCADA Pro-face BLUE software allows a malicious individual to execute arbitrary code.

The vulnerability of the SGIUtility component in Schneider Electric’s HMI terminal configuration software, as well as in the SCADA Pro-face BLUE software, is related to improper handling of a path leading to a limited catalog. Exploiting this vulnerability could allow an attacker to execute...

The vulnerability of cloud-based software for creating and using Nextcloud storage solutions is related to lack of access control measures, allowing attackers to gain unauthorized access to limited functions.

The vulnerability of cloud-based software for creating and using Nextcloud data storage solutions is related to lack of access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to limited functions of the system...

Vulnerabilities fixed in Google Chrome

Google has fixed vulnerabilities in Chrome. A malicious person could exploit the vulnerabilities to cause a denial-of-service, to gain access to system data, or to execute arbitrary code in the context of the browser of the victim. To do this, the malicious party must trick the victim into openin...

Cesanta MJS Denial of Service Vulnerability (CNVD-2023-29378)

Cesanta MJS is a JavaScript engine designed for microcontrollers with limited resources. Cesanta MJS version 2.20.0 contains a denial of service vulnerability that can be exploited by attackers to launch a denial of service attack...

CVE-2023-29112

The SAP Application Interface Message Monitoring - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limite...

CVE-2023-29112

The SAP Application Interface Message Monitoring - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limite...

CVE-2023-27897

In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform...

CVE-2023-1916

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff...

CVE-2023-1916

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff...