Lfi-Space - LFI Scan Tool

Written by TMRSWRR Version 1.0.0 All in one tools for LFI VULN FINDER -LFI DORK FINDER Instagram: TMRSWRR Screenshots How to use Read Me LFI Space is a robust and efficient tool designed to detectLocal File Inclusion LFI vulnerabilities in web applications. This tool simplifies the process of...

New Phishing-as-a-Service Platform Lets Cybercriminals Generate Convincing Phishing Pages

A new phishing-as-a-service PhaaS or PaaS platform named Greatness has been leveraged by cybercriminals to target business users of the Microsoft 365 cloud service since at least mid-2022, effectively lowering the bar to entry for phishing attacks. "Greatness, for now, is only focused on Microsof...

New Phishing-as-a-Service Platform Lets Cybercriminals Generate Convincing Phishing Pages

A new phishing-as-a-service PhaaS or PaaS platform named Greatness has been leveraged by cybercriminals to target business users of the Microsoft 365 cloud service since at least mid-2022, effectively lowering the bar to entry for phishing attacks. "Greatness, for now, is only focused on Microsof...

CVE-2023-29657

eXtplorer 2.1.15 is vulnerable to Insecure Permissions. File upload in file manager allows uploading zip file containing php pages with arbitrary code executions...

eXtplorer 代码问题漏洞

eXtplorer is a PHP-based file manager. A security vulnerability exists in eXtplorer version 2.1.15, which stems from vulnerability to insecure privileges, where the file upload feature in the file manager allows the upload of zip files that contain php pages with arbitrary code execution...

Jenkins User Interface (UI) Information Disclosure Vulnerability

Jenkins User Interface UI contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages...

Rockwell Automation ArmorStart ST 跨站脚本漏洞

Rockwell Automation ArmorStart ST is a simple and cost-effective solution for machine-side control architectures from Rockwell Automation. A cross-site scripting vulnerability exists in Rockwell Automation ArmorStart ST, which can be exploited by an attacker to view and modify sensitive data or...

WordPress Add Posts to Pages Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)

Software Add Posts to Pages Type Plugin Vulnerable versions = 1.4.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23826 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d4d055cb3569 Credits István Márton Required...

MAL-2023-569 Malicious code in little-heaven-by-nick-cutter-on-kindle-new-pages- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1118eac8c0f8eef839cf2daade621df7e1fc982faf90314a0bbb38622add51c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in american-street-by-ibi-zoboi-on-kindle-full-pages- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb1b7187e0d85c6c6d44002a25e63c833281927be47eafa6000c49b067767bde Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cloudflare Public Bug Bounty: Privilege escalation to root in Pages build image v2

Vulnerability description not provided...

kernel: powerpc/memhotplug: Add add_pages override for PPC

In the Linux kernel, the following vulnerability has been resolved: powerpc/memhotplug: Add addpages override for PPC With commit ffa0b64e3be5 "powerpc: Fix virtaddrvalid for 64-bit Book3E & 32-bit" the kernel now validate the addr against highmemory value. This results in the below BUGON with da...

kernel: mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: avoid corrupting page-mapping in hugetlbmcopyatomicpte In MCOPYATOMICCONTINUE case with a non-shared VMA, pages in the page cache are installed in the ptes. But hugepageaddnewanonrmap is called for them mistakenly...

kernel: nfsd: don't replace page in rq_pages if it's a continuation of last page

In the Linux kernel, the following vulnerability has been resolved: nfsd: don't replace page in rqpages if it's a continuation of last page The splice read calls nfsdspliceactor to put the pages containing file data into the svcrqst-rqpages array. It's possible however to get a splice result that...

kernel: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages

In the Linux kernel, the following vulnerability has been resolved: mm,hugetlb: take hugetlblock before decrementing h-resvhugepages The h-hugepages counters are protected by the hugetlblock, but allochugepage has a corner case where it can decrement the counter outside of the lock. This could le...

Moderate: Red Hat Security Advisory: golang-github-cpuguy83-md2man security, bug fix, and enhancement update

An update for golang-github-cpuguy83-md2man is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

PT-2023-12088 · Microsoft · Asp

Name of the Vulnerable Software and Affected Versions: ASP affected versions not specified Description: Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL, which may cause arbitrary memory values to be initialized to zero, potentially leading t...

ROS-20230505-01

Mozilla Thunderbird email client vulnerability involves invalid free operation from code JavaScript. Exploitation of the vulnerability could allow an attacker acting remotely to force the victim to to visit a specially crafted web page, cause memory corruption, and execute arbitrary code. The...

Cross Site Scripting in Open Web Analytics on most statistics related pages

Description The makeJson method within the owatemplate class generates a JSON string in an unsafe manner. This method is utilized within the report.tpl file, where it receives parameters from the URL and generates a JSON string using them without properly sanitizing. Proof of Concept The...

LOBSHOT: A Stealthy, Financial Trojan and Info Stealer Delivered through Google Ads

In yet another instance of how threat actors are abusing Google Ads to serve malware, a threat actor has been observed leveraging the technique to deliver a new Windows-based financial trojan and information stealer called LOBSHOT. "LOBSHOT continues to collect victims while staying under the...