200 matches found
CVE-2022-45472
CVE-2022-45472 XSS basado en DOM Software: CAE Learning Space Enterprise con licencia Intuity Versión de imagen: 267r Nivel de parche: 639 Vulnerabilidad: XSS basado en DOM Descripción El software de gestión CAE Learning Space Enterprise es vulnerable a un ataque de XSS basado en DOM. Un ataque d...
Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit
Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit CVE-2021-40444 EXPLOIT PARA USAR EN METASPLOIT, PERMITE A LOS ATACANTES OBTENER UNA EJECUCIÓN REMOTA DE CÓDIGO A TRAVÉS DE MICROSOFT OFFICE WORD AL INYECTAR CÓDIGO MALICIOSO EN EL ARCHIVO...
CVE-2024-3094-info
CVE-2024-3094-información https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - respuesta de Lasse Collin https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...
CVE-2024-3094_xz_check
CVE-2024-3094 xz 检测脚本 该仓库包含一个 Bash 脚本和一条单行命令，用于验证系统是否运行着 CVE-2024-3094 所指的易受攻击版本的“xz”工具。 以下描述和影响声明来自 RedHat 提供的信息（https://access.redhat.com/security/cve/CVE-2024-3094）： “ 在从 5.6.0 版本开始的“xz”上游 tarball 中识别出恶意代码。该代码涉及一种复杂方法，其中 liblzma 的构建过程从源代码中一个伪装成测试文件的预构建对象文件提取数据。随后，该文件被用于修改 liblzma 代码中的特定函数，导致...
Malicious code in thurdweb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 775ff15f4a1314978d4cfed1e97c6c9ac8621d8ddeed93160c25aa3681f73cc7 Package name thurdweb is a one-character substitution of the popular web3 SDK thirdweb, but the shipped source is a copy of MikeMcl/big.js...
Keras 路径遍历漏洞
Keras is an open-source deep learning framework developed by Keras. Versions of Keras prior to 3.14.0 contained a path traversal vulnerability. This vulnerability stemmed from a path traversal issue in the archive extraction tool. The functions filtersafetarinfos and filtersafezipinfos used to...
Attackers adopt JavaScript runtime Bun to spread NWHStealer
In our previous research, we analyzed a Windows infostealer we track as NWHStealer. The attackers behind this stealer are continuously finding new methods to distribute the stealer. During our hunting activities, we noticed how attackers are using a JavaScript runtime called Bun to help distribut...
EUVD-2019-20087
Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities that allow unauthenticated attackers to inject malicious code by manipulating URL parameters. Attackers can inject script tags through the cateid parameter in categorysearch.php or SQL code through the view...
PT-2026-28466
Name of the Vulnerable Software and Affected Versions Home Assistant versions 2020.02 through 2026.01 Description Home Assistant, an open-source home automation software, contains a flaw where an authenticated user can inject malicious code into a device entity name. This allows for Cross-Site...
CVE-2026-20116 Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
A vulnerability in the web-based management interface of Cisco Finesse, Cisco Packaged Contact Center Enterprise Packaged CCE, Cisco Unified Contact Center Enterprise Unified CCE, Cisco Unified Contact Center Express Unified CCX, and Cisco Unified Intelligence Center could allow an unauthenticate...
EUVD-2020-30957
Outline Service 1.3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in C:\Program Files x86\Outline to inject malicious code that would execute with...
CVE-2022-38625
Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. This vulnerability allows authenticated attackers to create and upload their own custom-built firmware and inject malicious code. NOTE: the vendor's position i...
CVE-2022-26947
Archer 6.x through 6.9 SP3 6.9.3.0 contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the...
CVE-2021-27602
SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the...
EUVD-2021-1147
Malware in sbrugna...
EUVD-2018-19886
Malware in sbrugna...
EUVD-2021-21015
Malware in sbrugna...
EUVD-2000-0876
Malware in sbrugna...