edeportes.aytosalamanca.es Cross Site Scripting vulnerability OBB-3641096

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-41180 Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++

Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default,...

PT-2023-25841 · Farsight Tech Nordic Ab · Provide

Name of the Vulnerable Software and Affected Versions: Farsight Tech Nordic AB ProVide version 14.5 Description: Multiple XSS vulnerabilities can be exploited by a user with administrator privilege. Recommendations: For version 14.5, consider disabling access to administrator privileges until a...

2023 OWASP Top-10 Series: API6:2023 Unrestricted Access to Sensitive Business Flows

Welcome to the 7th post in our weekly series on the new 2023 OWASP API Security Top-10 list, with a particular focus on security practitioners. This post will focus on API6:2023 Unrestricted Access to Sensitive Business Flows. In this series we are taking an in-depth look at each category – the...

Exploit for Out-of-bounds Write in Msi Afterburner

CVE-2019-16098 This CVE exploits the RTCore64.sys driver and...

Exploit for Use of a Broken or Risky Cryptographic Algorithm in Vmware Aria_Operations_For_Networks

CVE-2023-34039 POC for CVE-2023-34039 VMWare Aria Operations f...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 8 used by AIX. AIX has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-40609 DESCRIPTION: IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute...

Navigating privacy in a data-driven world with Microsoft Priva

Data protection and privacy have become business imperatives. In a global survey conducted by Microsoft and leaders in the academic privacy space, 90 percent of respondents said they would not buy from an organization that does not properly protect its data.1 More than ever, people have a high...

GE Digital CIMPLICITY

1. EXECUTIVE SUMMARY ​CVSS v3 7.8 ​ATTENTION: Low attack complexity ​Vendor: GE Digital ​Equipment: CIMPLICITY ​Vulnerability: Process Control 2. RISK EVALUATION ​Successful exploitation of this vulnerability could allow a low-privileged local attacker to escalate privileges to SYSTEM. 3...

PT-2023-21115 · Unknown · Notifyvisitors

Name of the Vulnerable Software and Affected Versions: NotifyVisitors plugin versions 1.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the NotifyVisitors plugin...

PT-2023-5166 · Fortinet · Forticlientems

Name of the Vulnerable Software and Affected Versions: FortiClientEMS versions 7.0.0 through 7.0.4 FortiClientEMS versions 7.0.6 through 7.0.7 FortiClientEMS versions 6.4 and earlier FortiClientEMS versions 6.2 and earlier Description: The issue is related to an exposure of sensitive information ...

PT-2023-24292 · Mohammad I. Okfie · Wp-Hijri

Name of the Vulnerable Software and Affected Versions: Mohammad I. Okfie WP-Hijri plugin versions 1.5.1 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

PT-2023-27663 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version US AC6V1.0BR V15.03.05.16 multi TD01.bin Description: The issue concerns a command execution vulnerability in the sub ADD50 function. This vulnerability is exploited when the formSetIptv function obtains the list and vlanId...

CVE-2023-39810

A flaw was found in the BusyBox tool. This issue occurs in the cpio command of BusyBox and may allow attackers to execute a directory traversal. If untrusted archives are extracted, this can result in files written outside of the destination directory or files being overwritten that contain...

CVE-2023-4611

A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind and VMA-locked page fault, and may allow a local attacker to crash the system or lead to a kernel information leak. Mitigation Mitigation for this...

CVE-2023-40857

A flaw was found in the yara library. This issue occurs due to a buffer overflow vulnerability in the exe.c component that allows a remote attacker to execute arbtirary code via the yrexecutecod function. Mitigation Mitigation for this issue is either not available or the currently available...

CVE-2022-48571

A buffer overflow flaw was found in memcached. This issue occurs via multi-packet uploads in UDP, leading to a denial of service. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use...

CVE-2020-18652

A buffer overflow flaw was found in the exempi package. This issue occurs in WEBPSupport.cpp and may allow remote attackers to cause a denial of service via opening a crafted webp file. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the...

WordPress Bridge Core Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)

Software Bridge Core Type Plugin Vulnerable versions = 3.0.9 Fixed in 3.1.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-40333 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d3de5f78c548 Credits Rafie Muhammad Patchstack Required...

WordPress Happy Elementor Addons Pro Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Happy Elementor Addons Pro Type Plugin Vulnerable versions = 2.8.0 Fixed in 2.8.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41236 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1e3539666fdb Credits Rafie...