Enabling NetScaler to forward original client source IP to backend server

This guide outlines the various methods available to ensure that the backend server is equipped to collect the original client IP through the NetScaler. The focus of this article lies in configuring the NetScaler to effectively forward the original client source IP to the backend server...

Linux/x64 - memfd_create ELF loader Shellcode (170 bytes)

Shellcode Title: Linux/x64 - memfdcreate ELF loader 170 bytes Shellcode Author: Ivan Nikolsky enty8080 & Tomas Globis tomasglgg Tested on: Linux x8664 Shellcode Description: This shellcode attempts to establish reverse TCP connection, reads ELF length, reads ELF and maps it into the memory, creat...

[SECURITY] Fedora 38 Update: ntpsec-1.2.2a-1.fc38

NTPsec is a more secure and improved implementation of the Network Time Protocol derived from the original NTP project...

HedgeDoc Security Vulnerabilities

HedgeDoc is a Javascript-based real-time editing and sharing platform for Markdown documents from the HedgeDoc team. A security vulnerability exists in HedgeDoc versions prior to 1.9.9, which stems from a vulnerability that allows an attacker to create a note that matches the ID of an original no...

RuoYi 跨站脚本漏洞

RuoYi is a backend management system for individual developers in China RuoYi RuoYi. A cross-site scripting vulnerability exists in RuoYi versions prior to 4.7.7. The vulnerability stems from a security issue in the uploadFilesPath function of the File Upload component, which leads to cross-site...

VX-API - Collection Of Various Malicious Functionality To Aid In Malware Development

The VX-API is a collection of malicious functionality to aid in malware development. It is recommended you clone and/or download this entire repo then open the Visual Studio solution file to easily explore functionality and concepts. Some functions may be dependent on other functions present with...

GHSA-47R2-PHR8-M8CP Apache Pulsar Broker Improper Authentication vulnerability

Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a...

Duplicate Advisory: Cosmos "Barberry" vulnerability in github.com/cosmos/cosmos-sdk

Withdrawn This advisory has been withdrawn because it is a duplicate of GHSA-j2cr-jc39-wpx5. This link is maintained to preserve external references. Original Description The cosmos-sdk module is affected by the vulnerability codenamed "Barberry"...

PT-2023-24762

Name of the Vulnerable Software and Affected Versions Gatsby versions prior to 4.25.7 and 5.9.1 Description The Gatsby framework contains a Local File Inclusion vulnerability in the file-code-frame and original-stack-frame paths, exposed when running the Gatsby develop server gatsby develop. Any...

Canonical Ubuntu 安全漏洞

Canonical Ubuntu is a GNU/Linux operating system for desktop applications from the British company Canonical. A security vulnerability exists in the Canonical Ubuntu Linux kernel OEM. An attacker has exploited the vulnerability to cause a denial of service on the system...

CVE-2023-23674

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in RVOLA WP Original Media Path plugin = 2.4.0 versions...

CVE-2023-23674

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in RVOLA WP Original Media Path plugin = 2.4.0 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in RVOLA WP Original Media Path plugin = 2.4.0 versions...

CVE-2023-23674

CVE-2023-23674 – WP Original Media Path (RVOLA) Stored XSS in plugin versions

WordPress plugin WP Original Media Path 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-23674: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in RVOLA WP Original Media Path plugin = 2.4.0 versions...

GHSA-WJ6R-53F5-Q789 Duplicate Advisory: AVideo contains Command injection when embedding a video link

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pgvh-p3g4-86jw. This link is maintained to preserve external references. Original Description Impact: An attacker could execute remote code on a system running wwbn/avideo Step to Reproduce: 1. Go to the My Vide...

novel-plus SQL injection vulnerability (CNVD-2023-32773)

novel-plus novel boutique-plus is a multi-end PC, WAP reading, functional original literature CMS system. novel-plus version 3.6.2 suffers from a SQL injection vulnerability, which originates from a problem with the file /news/list?limit=10&offset=0&order=desc, where the operation of the paramete...

WP Original Media Path < 2.4.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Important: ecs-service-connect-agent

Issue Overview: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token JWT checks and forge fake original paths. The header x-envoy-original-path should be an interna...