Hackers Weaponize Windows Flaw to Deploy Crypto-Siphoning Phemedrone Stealer

Threat actors have been observed leveraging a now-patched security flaw in Microsoft Windows to deploy an open-source information stealer called Phemedrone Stealer. "Phemedrone targets web browsers and data from cryptocurrency wallets and messaging apps such as Telegram, Steam, and Discord," Tren...

YzmCMS Cross-Site Scripting Vulnerability (CNVD-2024-02989)

Yzmcms is an open source CMS Content Management System. YzmCMS version 6.5 to 7.0 cross-site scripting vulnerability, the vulnerability stems from the member/index/register.html page of the Referer HTTP header of the user-supplied data lack of effective filtering and escaping, an attacker can...

Drupal Security Vulnerabilities

Drupal is an open source content management system developed in PHP by the Drupal community. A security vulnerability exists in Drupal version 9.3.6, which stems from the presence of a Denial of Service DoS vulnerability...

What is Kafka?

Introduction to the Universe of Kafka: A Detailed Synopsis Apache Kafka, frequently just labeled as Kafka, is a universally contributed event broadcasting framework, intended to manage live streaming of data. It is engineered to be a bridge for significant volumes of data, offering a mechanism fo...

Malicious code in wdpr-device-detection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0e68ddd57d0cced6084c7770f4e48230e223d896f927b8952e4cf5d05caa721f The OpenSSF Package Analysis project identified 'wdpr-device-detection' @ 24.7.16 npm as malicious. It is considered malicious because: - The...

EasyEASM - Zero-dollar Attack Surface Management Tool

Zero-dollar attack surface management tool featured at Black Hat Arsenal 2023 and Recon Village @ DEF CON 2023. Description Easy EASM is just that... the easiest to set-up tool to give your organization visibility into its external facing assets. The industry is dominated by $30k vendors selling...

Detect and Manage the Risk of Apache Struts (CVE-2023-50164) Comprehensively

Introduction In the vast landscape of cybersecurity, staying vigilant against potential threats is crucial. A critical vulnerability that surfaced recently is CVE-2023-50164, affecting Apache Struts 2, a widely used open-source framework for Java development. This path traversal vulnerability,...

CVE-2023-42463

Wazuh is a free and open source platform used for threat prevention, detection, and response. This bug introduced a stack overflow hazard that could allow a local privilege escalation. This vulnerability was patched in version 4.5.3...

Design/Logic Flaw

Wazuh is a free and open source platform used for threat prevention, detection, and response. This bug introduced a stack overflow hazard that could allow a local privilege escalation. This vulnerability was patched in version 4.5.3...

Faculty Management System SQL Injection Vulnerability

Faculty Management System is a code-projects open source faculty management system. code-projects Faculty Management System version 1.0 SQL injection vulnerability , the vulnerability stems from /admin/pages/student-print.php file has a SQL injection vulnerability...

GPAC Denial of Service Vulnerability (CNVD-2024-06174)

GPAC is an open source multimedia framework. A denial of service vulnerability exists in GPAC version 2.3-DEV, which originates from an infinite loop in function av1uvlc in mediatools/avparsers.c. An attacker can exploit this vulnerability to cause a denial of service...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from a denial of service vulnerability that stems from the ability to create very long user arrays in the message serializer, which can be exploited...

Linux kernel code issue vulnerability (CNVD-2024-06235)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A code issue vulnerability exists in the Linux kernel that stems from vhostnewmsg in drivers/vhost/vhost.c failing to properly initialize memory in messages passed between a...

pocsuite3

This is a Python-based framework for remote vulnerability testing and proof-of-concept development, called pocsuite3. It is developed by the Knownsec 404 Team and is designed for penetration testers and security researchers. The framework comes with a powerful proof-of-concept engine and various...

Cross site scripting

Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with responsemode=formpost. This relatively user could use the described attacks to perform a privilege escalation. This...

CVE-2024-21637

Authentik (open-source Identity Provider) is affected by a reflected XSS in OpenID Connect flows using JavaScript-URIs with response_mode=form_post. The issue targets the authentication redirect path (Redirect URI) and could be used to escalate privileges as described in CVE-2024-21637. The vulne...

[SECURITY] Fedora 39 Update: chromium-120.0.6099.216-1.fc39

Chromium is an open-source web browser, powered by WebKit Blink...

Bus Reservation System Security Vulnerability

Bus Reservation System is PHPJabbers open source a bus reservation system . Bus Reservation System 1.1 version has a security vulnerability , the vulnerability stems from the existence of a lost rate limit vulnerability...

Bus Reservation System Security Vulnerability

Bus Reservation System is PHPJabbers open source a bus reservation system . Bus Reservation System 1.1 version has a security vulnerability , the vulnerability stems from the existence of CSV injection vulnerability...

Tecnick TCExam Security Breach

Tecnick TCExam is a Web-based open source e-exam system from Tecnick UK. The system is mainly used for online exams, etc. A security vulnerability exists in Tecnick TCExam versions prior to 15.1.0, which stems from an insufficiently protected external authorization mechanism in the admin folder...