OESA-2024-1263 stb security update

Single-file public domain libraries for C/C++. Security Fixes: stbimage is a single file MIT licensed library for processing images. It may look like stbiloadgifmain doesn’t give guarantees about the content of output value delays upon failure. Although it sets delays to zero at the beginning, it...

elFinder Web file manager Version - 2.1.53 Remote Command Execution Vulnerability

Exploit Title: elFinder Web file manager Version: 2.1.53 Remote Command Execution Exploit Author: tmrswrr Google Dork: intitle:"elFinder 2.1.53" Vendor Homepage: https://studio-42.github.io/elFinder/ Software Link: https://github.com/Studio-42/elFinder/archive/refs/tags/2.1.53.zip Version: 2.1.53...

elFinder Web file manager Version - 2.1.53 Remote Command Execution

Exploit Title: elFinder Web file manager Version: 2.1.53 Remote Command Execution Date: 23/11/2023 Exploit Author: tmrswrr Google Dork: intitle:"elFinder 2.1.53" Vendor Homepage: https://studio-42.github.io/elFinder/ Software Link: https://github.com/Studio-42/elFinder/archive/refs/tags/2.1.53.zi...

openSUSE: Security Advisory for virtualbox (openSUSE-SU-2023:0351-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-51800

Cross Site Scripting XSS vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the mainsettings component in the phone, address, bank, accname, accnumber parameters, newclass and cname parameter, addnewparent function in t...

CVE-2024-1976: Cross-Site Request Forgery (CSRF)

The Marketing Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20200925. This is due to missing or incorrect nonce validation via the admin/main-settings-page.php file. This makes it possible for unauthenticated attackers to update t...

CVE-2023-51800

Cross Site Scripting XSS vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the mainsettings component in the phone, address, bank, accname, accnumber parameters, newclass and cname parameter, addnewparent function in t...

CVE-2023-51800

Cross Site Scripting XSS vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the mainsettings component in the phone, address, bank, accname, accnumber parameters, newclass and cname parameter, addnewparent function in t...

Cybersecurity Agencies Warn Ubiquiti EdgeRouter Users of APT28's MooBot Threat

In a new joint advisory, cybersecurity and intelligence agencies from the U.S. and other countries are urging users of Ubiquiti EdgeRouter to take protective measures, weeks after a botnet comprising infected routers was felled by law enforcement as part of an operation codenamed Dying Ember. The...

PT-2024-14294 · Unknown · School Management System

Name of the Vulnerable Software and Affected Versions: School Fees Management System version 1.0 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via a crafted payload to the main settings component in the phone, address, bank, acc name, acc number...

CVE-2023-50379 Apache Ambari: authenticated users could perform command injection to perform RCE

Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host...

Atheme Security Breach

Atheme is a set of IRC services open-sourced by Atheme. A security vulnerability exists in Atheme version 7.2.12, which stems from a memory leak contained in /atheme/src/crypto-benchmark/main.c. The vulnerability is caused by a memory leak in /atheme/src/crypto-benchmark/main.c, which contains a...

PT-2024-18303 · Limbas · Limbas

Name of the Vulnerable Software and Affected Versions: Limbas version 5.2.14 Description: A vulnerability was found in an unknown functionality of the file main admin.php. The manipulation of the tab group argument leads to sql injection. The complexity of an attack is rather high, and the...

CVE-2024-22854: Improper Neutralization of Input During Web Page Generation

DOM-based HTML injection vulnerability in the main page of Darktrace Threat Visualizer version 6.1.27 bundle version 61050 and before has been identified. A URL, crafted by a remote attacker and visited by an authenticated user, allows open redirect and potential credential stealing using an...

PT-2024-19586 · Darktrace · Darktrace Threat Visualizer

Name of the Vulnerable Software and Affected Versions: Darktrace Threat Visualizer versions 6.1.27 and before Description: A DOM-based HTML injection vulnerability has been identified in the main page of Darktrace Threat Visualizer. This issue allows a remote attacker to craft a URL that, when...

CVE-2024-1432 DeepFaceLab main.py apply_xseg deserialization

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22 and classified as problematic. This issue affects the function applyxseg of the file main.py. The manipulation leads to deserialization. The attack may be initiated remotely. The complexity of ...

The vulnerability of the soapcgi_main function in D-Link DIR-815 router microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the soapcgimain function in D-Link DIR-815 router microprogramming software arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-22852

D-Link Go-RT-AC750 GORTAC750A1FWv101b03 contains a stack-based buffer overflow via the function genacgimain. This vulnerability allows attackers to enable telnet service via a specially crafted payload...

python-multipart Resource Management Error Vulnerability

python-multipart is a streaming multipart parser for Python by the individual developer Marcelo Trylesinski. A resource management error vulnerability exists in versions prior to python-multipart 0.0.7, which stems from the package python-multipart consuming CPU resources and stopping indefinitel...

TOTOLINK N200RE main function buffer overflow vulnerability

The TOTOLINK N200RE is a wireless router for the SOHO market. The TOTOLINK N200RE suffers from a buffer overflow vulnerability that originates from a stack-based buffer overflow in the main function of //cgi-bin/cstecgi.cgi. No detailed vulnerability details are provided at this time...