CVE-2022-38973

Improper access control for some IntelR ArcTM graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow an authenticated user to potentially enable denial of service or infomation disclosure via local access...

October CMS 3.4.4 Cross Site Scripting

Exploit Title: October CMS v3.4.4 - Stored Cross-Site Scripting XSS Authenticated Date: 29 June 2023 Exploit Author: Okan Kurtulus Vendor Homepage: https://octobercms.com Version: v3.4.4 Tested on: Ubuntu 22.04 CVE : N/A Proof of Concept: 1– Install the system through the website and log in with...

Stored Cross-Site Scripting (XSS)

october/october is vulnerable to Stored Cross-Site Scripting. The vulnerability is due to a lack of sanitization in the user authentication module, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated)

Exploit Title: October CMS v3.4.4 - Stored Cross-Site Scripting XSS Authenticated Date: 29 June 2023 Exploit Author: Okan Kurtulus Vendor Homepage: https://octobercms.com Version: v3.4.4 Tested on: Ubuntu 22.04 CVE : N/A Proof of Concept: 1– Install the system through the website and log in with...

October CMS v3.4.4 - Stored Cross-Site Scripting (Authenticated) Vulnerability

Exploit Title: October CMS v3.4.4 - Stored Cross-Site Scripting XSS Authenticated Exploit Author: Okan Kurtulus Vendor Homepage: https://octobercms.com Version: v3.4.4 Tested on: Ubuntu 22.04 CVE : N/A Proof of Concept: 1– Install the system through the website and log in with any user with file...

BlueHat October 2023 Call for Papers is Now Open!

As you may have seen on social media, the next BlueHat conference will be October 11 – 12, 2023, on Microsoft’s Redmond campus in Washington state, USA. The Call for Papers CFP is now open through August 18, 2023. The BlueHat community is a unique blend of security researchers and responders from...

GHSA-R47V-RXCG-P28J Stored Cross-Site Scripting October CMS

An svg file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code in the context of a browser via a crafted svg file. Attackers must be authenticated as users...

Stored Cross-Site Scripting October CMS

An svg file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code in the context of a browser via a crafted svg file. Attackers must be authenticated as users...

CVE-2023-37692

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file...

CVE-2023-37692

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file...

CVE-2023-37692

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file...

Design/Logic Flaw

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file...

CVE-2023-37692

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file...

CVE-2023-37692

An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file...

PT-2023-26079 · Unknown · October Cms

Name of the Vulnerable Software and Affected Versions: October CMS version 3.4.4 Description: The issue allows attackers to execute arbitrary code via a crafted file, specifically an svg file, which can be uploaded to the system. This can be done in the context of a browser and requires the...

October CMS 跨站脚本漏洞

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A security vulnerability exists in October CMS version v3.4.4, which stems from an arbitrary file upload vulnerability in October CMS...

CVE-2023-37692

October CMS v3.4.4 is affected by an arbitrary file upload vulnerability that allows an authenticated attacker to upload a crafted file (notably an SVG) to execute arbitrary code in the browser context. The issue appears to stem from inadequate validation/sanitization in the file upload handling,...

Oracle MySQL Server 8.0.x < 8.0.34 (October 2023 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Packaging OpenSSL. Supported versions that are affected are 5.7.42 and...

CVE-2023-37266

creationtimestamp| type| source ---|---|--- 2023-07-18 00:45:24+00:00| seen| https://t.me/cibsecurity/66856 2023-10-17 17:35:31+00:00| seen| https://t.me/KomunitiSiber/945 2023-10-17 17:40:39+00:00| seen| Telegram/DhBuM5h9ZembCAXJLb1SO10emtONhvTPWBycf14R0dULg...

Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ Goals

Void Rabisu, a malicious actor believed to be associated with the RomCom backdoor, was thought to be driven by financial gain because of its ransomware attacks. But in this blog entry, we discuss how the use of the RomCom backdoor in recent attacks shows how Void Rabisu's motives seem to have...