UBUNTU-CVE-2023-21898

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

CVE-2023-22624

Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks...

CVE-2023-22624

Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks...

Design/Logic Flaw

Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks...

PT-2023-18594 · Zoho · Zoho Manageengine Exchange Reporter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Exchange Reporter Plus versions prior to 5708 Description: The issue allows attackers to conduct XXE XML External Entity attacks. This type of attack occurs when an application parses XML input that contains malicious extern...

ZOHO ManageEngine Exchange Reporter Plus 5708 代码问题漏洞

ZOHO ManageEngine Exchange Reporter is a hybrid Exchange and Skype for Business reporting, auditing and monitoring solution from ZOHO. A security vulnerability previously existed in ZOHO ManageEngine Exchange Reporter Plus version 5708, which stemmed from the presence of an XML external entity...

CVE-2023-22624

CVE-2023-22624 affects Zoho ManageEngine Exchange Reporter Plus prior to 5708. The issue is an XML External Entity (XXE) processing flaw in the product’s XML handling, enabling an attacker to abuse XML input to perform XXE attacks. Public references in the connected documents consistently state t...

WordPress MainWP Post Plus Extension Plugin <= 4.0.3 is vulnerable to Arbitrary Content Deletion

Software MainWP Post Plus Extension Type Plugin Vulnerable versions = 4.0.3 Fixed in 4.1.1 OWASP Top 10 A5: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2023-23666 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 66ca6cd7da00 Credits Dave Jong...

CVE-2023-22624

Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks...

PT-2023-34393 · Libbpf · Libbpf

Name of the Vulnerable Software and Affected Versions: libbpf versions prior to v5.10.163 Description: The issue concerns enum forward-declarations in the public API when libbpf is used in C++ mode. It has been fixed in Linux Kernel version v5.10.163. Recommendations: For versions prior to...

Recog Release v3.0.3

Recog Release v3.0.3, which is available now, includes updated fingerprints for Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus; Atlassian Bitbucket Server; and Supervisord Supervisor. It also includes new fingerprints and a number of bug fixes, all of which are detailed...

Intel(R) oneAPI DPC++/C++ Compiler 代码问题漏洞

IntelR oneAPI DPC++/ c++ Compiler is a compiler from Intel Corporation USA. A code issue vulnerability exists in IntelR oneAPI DPC++/ c++ Compiler versions prior to 2022.2.1, which stems from an uncontrolled search path that allows authenticated users to elevate privileges via local access...

ManageEngine ServiceDesk Plus Unauthenticated SAML RCE

This exploits an unauthenticated remote code execution vulnerability that affects Zoho ManageEngine ServiceDesk Plus versions 14003 and below CVE-2022-47966. Due to a dependency to an outdated library Apache Santuario version 1.4.1, it is possible to execute arbitrary code by providing a crafted...

CVE-2022-4479

The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

Cross site scripting

The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

CVE-2022-4479

CVE-2022-4479 affects the WordPress plugin Table of Contents Plus v2212 and earlier. The vulnerability arises because the plugin does not validate and escape certain shortcode attributes before echoing them in the page, enabling a Stored XSS attack. Impacted scenario: a user with as little as the...

CVE-2022-4479 Table of Contents Plus < 2212 - Contributor+ Stored XSS

The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

CVE-2022-4479 Table of Contents Plus < 2212 - Contributor+ Stored XSS

The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

A week in security (January 1 - 8)

Last week on Malwarebytes Labs: Why does technology no longer excite us? Lock and Code S04E01 New device? Here's how to safely dispose of your old one LastPass updates security notice with information about a recent incident Okta breached last month, no customers compromised Update VPN Plus Serve...

PT-2023-14554 · WordPress · Table Of Contents Plus

Name of the Vulnerable Software and Affected Versions: Table of Contents Plus WordPress plugin versions prior to 2212 Description: The issue concerns a lack of validation and escaping of certain shortcode attributes, which could lead to Stored Cross-Site Scripting attacks. Users with a role as lo...