1681 matches found
Malicious code in yfiance (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6c722a77439d6a24ce5b4c77e728ac92edde6c7327fc6849f363376cef1f1421 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...
CVE-2022-48295
The IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to filling problems batch installation of applications...
A Bootiful Podcast: Moderne founder Jon Schneider on OpenRewrite, modernizing code bases en masse, freedom and responsibility, and more
Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Moderne @moderneinc founder Jon Schneider @jonkschneider on OpenRewrite, modernizing code bases en masse, freedom and responsibility, and more...
Improper Access Control
cakephp/cakephp is vulnerable to Improper Access Control. The vulnerability exists due to mass assignment issues when multiple POST requests manipulate the same model allowing an attacker to perform cross form submissions to the SecurityComponent...
GHSA-J9Q2-F9Q7-JHGQ CakePHP SecurityComponent cross form submission issue
Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues...
CakePHP SecurityComponent cross form submission issue
Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues...
PT-2023-33038 · Unknown · Securitycomponent
Name of the Vulnerable Software and Affected Versions: Software versions prior to 2.4.8 and 1.3.18 Description: The issue allows forms secured by SecurityComponent to be submitted to any action without triggering the tampering protection. This could lead to mass assignment issues in applications...
Thinking of Hiring or Running a Booter Service? Think Again.
Most people who operate DDoS-for-hire businesses attempt to hide their true identities and location. Proprietors of these so-called "booter" or "stresser" services -- designed to knock websites and users offline -- have long operated in a legally murky area of cybercrime law. But until recently,...
Mozilla Thunderbird Resource Management Error Vulnerability (CNVD-2023-03056)
Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. A resource management error vulnerability exists in Mozilla Thunderbird, which stems from...
Design/Logic Flaw
An issue was discovered in the fpnewsletter aka Newsletter subscriber management extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. There is a CAPTCHA bypass that can lead to subscribing many people...
TYPO3 安全漏洞
TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 fpnewsletter, which stems from the fact that its CAPTCHA can be bypassed leading to many subscriptions...
PT-2022-28058 · Typo3 · Fp Newsletter
Name of the Vulnerable Software and Affected Versions: fp newsletter extension versions 1.0 through 1.1.0 fp newsletter extension version 1.2.0 fp newsletter extension versions 2.0 through 2.1.1 fp newsletter extension versions 2.2.1 through 2.4.0 fp newsletter extension versions 3.0 through 3.2....
CVE-2022-47408
CVE-2022-47408 – TYPO3 fp_newsletter CAPTCHA bypass is documented across multiple sources. The vulnerability affects the fp_newsletter (Newsletter subscriber management) extension for TYPO3, with affected versions ranging from 1.0 through 1.1.0, 1.2.0, 2.0 through 2.1.1, 2.2.1 through 2.4.0, and ...
Exploit for Code Injection in Apache Commons_Text
CVE-2022-42889-text4shell 🔥🔥🔥 Apache commons text - CVE-2022-...
Exploit for Improper Authentication in Fortinet Fortiproxy
CVE-2022-40684-POC FortiProxy / FortiOS Authentication bypass...
CVE-2022-39302 Ree6 may bypass webhook protection
Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel and bypass raid and webhook protection...
CVE-2022-39302 Ree6 may bypass webhook protection
Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel and bypass raid and webhook protection...
CVE-2022-39302 Ree6 may bypass webhook protection
Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel and bypass raid and webhook protection...
Weblate: No rate limiting for Remove Account lead to huge Mass mailings
Name of the vulnerability:- No rate limiting for Remove Account lead to huge Mass mailings Hlw Team I am a security researcher and I found this vulnerability in your website Business Logic Errors https://hosted.weblate.org Description : No Rate Limit is a type of computer security vulnerability...