WordPress plugin Easy Google Maps 跨站请求伪造漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Easy Google Maps plugin version 1.11.7 and earlier versions. The vulnerability stem...

OSEC-2023-01 Time of check time of use issue in opam's cache

Bug description Opam uses since version 2.0.0 a download cache: if a source artifact is needed, first its hash is looked up in the local cache /.opam/download-cache//. Opam supports multiple hash algorithms, a cache lookup tries all hash algorithms present in the opam file. Before opam 2.1.5, the...

On the Poisoning of LLMs

Interesting essay on the poisoning of LLMs--ChatGPT in particular: Given that weve known about model poisoning for years, and given the strong incentives the black-hat SEO crowd has to manipulate results, its entirely possible that bad actors have been poisoning ChatGPT for months. We dont know...

Exploit for HTTP Request Smuggling in Apache Http_Server

CVE 2023 25690 - Proof of Concept Published: 7 March 2023...

Security Bulletin: Open Source Dependency Vulnerability

Summary IBM Edge Application Manager 4.5 has resolved the vulnerability. Vulnerability Details IBM X-Force ID: 239925 DESCRIPTION: Apollo GraphQL Apollo Server is vulnerable to web cache poisoning, caused by improper handling of cache-control response header. By modifying HTTP request headers, an...

CVE-2023-26125

A flaw was found in Gin-Gonic Gin. This flaw allows a remote attacker to bypass security restrictions caused by improper input validation. An attacker can perform cache poisoning attacks by sending a specially-crafted request using the X-Forwarded-Prefix header. Mitigation Mitigation for this iss...

DNS Poisoning Attacks

Akka is vulnerable to DNS Poisoning Attacks. The vulnerability exists because the Async DNS resolver of the library uses insufficient entropy to protect against DNS poisoning, which leads to the exfiltration of application data, allowing an attacker to cause denial of access to the service...

GHSA-6VCF-CFJP-QXCW LavaLite vulnerable to web cache poisoning

LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning...

LavaLite vulnerable to web cache poisoning

LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning...

CVE-2023-27238

LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning...

Design/Logic Flaw

LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning...

SUSE CVE-2023-31442

In Lightbend Akka before 2.8.1, the async-dns resolver used by Discovery in DNS mode and transitively by Cluster Bootstrap uses predictable DNS transaction IDs when resolving DNS records, making DNS resolution subject to poisoning by an attacker. If the application performing discovery does not...

CVE-2023-27238

LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning...

LavaLite 安全漏洞

LavaLite is an open source lightweight content management system CMS. A security vulnerability exists in LavaLite CMS version v 9.0.0 that stems from vulnerability to network cache poisoning...

CVE-2023-27238

LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning...

CVE-2023-27238

CVE-2023-27238 affects LavaLite CMS v9.0.0, described in the provided documents as vulnerable to web cache poisoning. The materials do not specify the exact vulnerable component, root cause, affected configurations, or exploit details. Exploitation status is not described in the supplied document...

SUSE: Security Advisory (SUSE-SU-2023:2183-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-27238

LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning...

CVE-2023-31442

In Lightbend Akka before 2.8.1, the async-dns resolver used by Discovery in DNS mode and transitively by Cluster Bootstrap uses predictable DNS transaction IDs when resolving DNS records, making DNS resolution subject to poisoning by an attacker. If the application performing discovery does not...

CVE-2023-31442

In Lightbend Akka before 2.8.1, the async-dns resolver used by Discovery in DNS mode and transitively by Cluster Bootstrap uses predictable DNS transaction IDs when resolving DNS records, making DNS resolution subject to poisoning by an attacker. If the application performing discovery does not...