Exploit for Files or Directories Accessible to External Parties in Apache Struts

CVE-2023-50164 : Apache Struts 2 vulnerable Docker container...

CVE-2023-50459

CVE-2023-50459 corresponds to a Broken Access Control issue in the TYPO3 extension femanager (in2code). The connected advisories identify the vulnerable components as the check_edit_user component (improper access checks) and a missing backend access check, enabling an authenticated frontend user...

CVE-2023-3283

The connected Palo Alto advisory PA-CVE-2023-6789 details a stored XSS vulnerability in PAN-OS web interface. It allows a malicious authenticated read-write administrator to store a JavaScript payload via the web interface, which executes when viewed by an authenticated administrator, proxying al...

Spanish Police Nab Venezuelan Leader of Kelvin Security Hacker Group

By Waqas The arrested Venezuelan individual now faces charges including membership in a criminal organization, disclosure of secrets, computer damage, and money laundering. This is a post from HackRead.com Read the original post: Spanish Police Nab Venezuelan Leader of Kelvin Security Hacker Grou...

Generic Secret Disclosure

Most of the web applications rely on various public services to provide features to their users. In secure designs, consuming these private services will require authentication like API and private keys, username and password based credentials and similar sensitive data. Developers sometimes hard...

CVE-2023-37366

CVE-2023-37366 is a DoS flaw affecting Google Pixel cellular baseband/modem components. Public details from Pixel security bulletin map it to a DoS issue for Pixel devices (2023-12 patch level). An OSV entry confirms a root cause in cd_parseMsg of cd_codec.c where improper input validation can ca...

CVE-2023-6396

GitLab CE/EE is affected by CVE-2023-6396 due to XSS and ReDoS in Markdown via the Banzai pipeline when a member has admin_group_member permission, potentially allowing escalation (e.g., adding members with higher roles) and exposure of internal project details. The issue is tied to a bypass of C...

CVE-2023-43020

CVE-2023-43020 is evidenced in IBM bulletins as a denial-of-service vulnerability in IBM Db2 (including Db2 Connect Server) when processing a specially crafted query. Affected products span Db2 on Linux/UNIX/Windows (versions 10.5, 11.1, 11.5; Db2 Big SQL is also listed in related bulletins). The...

CVE-2023-6218

In Progress MOVEit Transfer versions released before 2022.0.9 14.0.9, 2022.1.10 14.1.10, 2023.0.7 15.0.7, a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an...

Privilege escalation

In Progress MOVEit Transfer versions released before 2022.0.9 14.0.9, 2022.1.10 14.1.10, 2023.0.7 15.0.7, a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an...

CVE-2023-42219

Exim MTA vulnerability CVE-2023-42219 is described in the connected Malwarebytes entry as allowing network-adjacent attackers to disclose sensitive information on affected installations of Exim. The article also notes that Exim is not likely to fix CVE-2023-42219 and suggests mitigations such as ...

CVE-2023-4822

A flaw was found in the Grafana enterprise package. Grafana is incorrectly assessing permissions to update global roles and role assignments, therefore, users with administrator permissions in one organization can change global role permissions and global role assignments. After successful...

CVE-2020-8909

Technical details for CVE-2020-8909 are not provided in the supplied documents. IBM bulletin references other CVEs and products but does not disclose specifics for this candidate. Monitor for updates.

PT-2023-7247 · Ipswitch · Moveit Transfer

Name of the Vulnerable Software and Affected Versions: MOVEit Transfer versions prior to 2022.0.9 14.0.9 MOVEit Transfer versions prior to 2022.1.10 14.1.10 MOVEit Transfer versions prior to 2023.0.7 15.0.7 Description: A privilege escalation path associated with group administrators has been...

CVE-2023-39120

Nodogsplash is affected by a directory traversal vulnerability (CVE-2023-39120) that also impacts OpenWrt. The issue allows remote attackers to read arbitrary files from the target system and is mitigated by upgrading Nodogsplash to version 5.0.1. The Nuclei template notes the vulnerability and s...

CVE-2023-1434

Odoo prior to 16.0 is vulnerable to CVE-2023-1434 due to an incorrect Content-Type on an API endpoint, enabling Cross-Site Scripting. The NUCLEI template notes the issue affects versions before 16.0 and describes the root cause as a mis-set content type in an API handler. Impactally, successful e...

CVE-2021-28854

VICIdial Web Client is reported vulnerable to information disclosure (CVE-2021-28854). The Nuclei template describes that sensitive files are accessible from the client side, including mysqli logs, auth logs, debug information, login attempts (successful and unsuccessful) with IPs, User-Agents, a...

CVE-2018-16341

Nuxeo prior to 10.3 is vulnerable to an unauthenticated remote code execution via server-side template injection. An attacker can execute arbitrary code on the affected system. The Nucleo template-exploitation details show an SSTI path in the login flow, confirming impact as remote code execution...

CVE-2018-10818

Connected document details confirm CVE-2018-10818 affects LG NAS devices, via a pre-auth remote command injection in the password parameter exposed through the /system/sharedir.php endpoint. The attack vector is unauthenticated and could enable arbitrary code execution on affected devices. Concre...

CVE-2023-40118

CVE-2023-40118 is addressed in ChromeOS updates as part of the Android Runtime Container security fixes. The connected ChromeOS release notes indicate CVE-2023-40118 was fixed as a Medium severity issue on impacted platforms within the Android Runtime Container, in the context of the ChromeOS Sta...