Design/Logic Flaw

Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a %LOCALAPPDATA%\Temp\NcpSupport location...

CVE-2023-43116

Buildkite Elastic CI for AWS is affected by a symbolic link following vulnerability in versions prior to 6.7.1 and 5.22.5. The issue lets the buildkite-agent user change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script. Affecte...

CVE-2023-44694

D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /log/mailrecvview.php...

PT-2023-5535 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L B1 version 2.02 Description: The issue is related to a buffer overflow in the formSetWAN Wizard55 function, which can be exploited by a remote attacker to cause a denial of service. This occurs when data is written beyond the...

D-Link DIR-816 A2 Buffer Error Vulnerability

The D-Link DIR-816 A2 is a wireless router from China-based AUO D-Link. A security vulnerability exists in D-Link DIR-816 A2 v1.10CNB05, which originates from a parameter sipaddress found to contain a stack overflow via ipportFilter...

Discourse 竞争条件问题漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse suffers from a competitive conditions issue vulnerability that arises from the ability to create more users than allowed via an invitation link...

Deskpro 代码问题漏洞

Deskpro is a suite of helpdesk software from Deskpro UK. The software includes a customer relationship management component, among other things, and offers features such as email, live chat, and voice. A security vulnerability exists in Deskpro Support Desk version v2021.21.6. An attacker could...

The vulnerability of D-Link DIR-550A and DIR-604M router microprogramming systems arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This vulnerability allows a hacker to execute arbitrary code.

The vulnerability of D-Link DIR-550A and DIR-604M router microprogramming systems exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Radancy: insecure storage of information, you can view any file uploaded to the server without authentication and only with a single link

Domain and URL: http://███ https://███████ https://████/maximum-wiki-prod-app/ Summary: From a single link I have access to a multitude of uploaded files on the server. All I have to do is search for keywords such as "png" or "user" and I can retrieve the target file without authentication, witho...

CVE-2023-32315

creationtimestamp| type| source ---|---|--- 2023-05-29 08:24:40+00:00| published-proof-of-concept| https://t.me/proxybar/1546 2023-05-29 11:08:45+00:00| published-proof-of-concept| https://t.me/arvinclub1/271 2023-05-30 15:18:17+00:00| published-proof-of-concept| https://t.me/dilagrafie/3072...

Tornado 输入验证错误漏洞

Tornado is a Python web framework and asynchronous networking library from the Chinese Tornado Technology Tornado community. The library scales to thousands of open connections through the use of non-blocking network I/O, making it well suited for long-time polling, WebSockets, and other...

CVE-2023-31701

TP-Link TL-WPA4530 KIT V2 EU170406 and V2 EU161115 is vulnerable to Command Injection via httpRpmPlcDeviceRemove...

Alert: Active Exploitation of TP-Link, Apache, and Oracle Vulnerabilities Detected

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added three flaws to the Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The security vulnerabilities are as follows - CVE-2023-1389 CVSS score: 8.8 - TP-Link Archer AX-21 Command Injection...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-1389 TP-Link Archer AX-21 Command Injection Vulnerability CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data Vulnerability CVE-2023-21839 Oracle...

CVE-2018-17883

An issue was discovered in Open Ticket Request System OTRS 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS...

CVE-2023-26822

D-Link Go-RT-AC750 revAv101b03 was discovered to contain a command injection vulnerability via the service parameter at soapcgi.main...

emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90

...

The Secret Vulnerability Finance Execs are Missing

The Other Risk in Finance A few years ago, a Washington-based real estate developer received a document link from First American – a financial services company in the real estate industry – relating to a deal he was working on. Everything about the document was perfectly fine and normal. The odd...

CVE-2023-25168 Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings

Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with GHSA-p8r3-83r8-jwj5 to overwrite files on the host system. In order to use this exploit, an attacker must have an...

CVE-2023-25152 Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on the host system that previously did not exist, potentially allowing attackers to change their resource allocations, promote their...