Former TikTok exec: Chinese Communist Party had "God mode" entry to US data

A former executive at TikToks parent company ByteDance has claimed in court documents that the Chinese Communist Party CCP had access to TikTok data, despite the data being stored in the US. The allegations were made in a wrongful dismissal lawsuit which was filed in May in the San Francisco...

The vulnerabilities of the MP4BytesProperty and MP4StringProperty classes in the library for creating, modifying, and reading MP4 files, mp4v2, allow attackers to cause service interruptions.

The vulnerability of the MP4BytesProperty and MP4StringProperty classes in the library for creating, modifying, and reading MP4 files, mp4v2, is related to the issue where operations are performed outside of the buffer during the processing of variable count values. Exploiting this vulnerability...

CVE-2023-33657

A use-after-free vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nnimqttmsggetpublishproperty in the file mqttmsg.c. This vulnerability is caused by improper data tracing, and an attacker could exploit it to cause a denial of service attack...

NanoMQ 资源管理错误漏洞

NanoMQ is a lightweight and fast MQTT Broker for IoT edge platforms open-sourced by EMQ Technologies, USA. A security vulnerability exists in NanoMQ version 0.17.2, which stems from improper data tracking and can trigger memory reuse after release by calling the function...

PT-2023-24436 · Nanomq · Nanomq

Name of the Vulnerable Software and Affected Versions: NanoMQ version 0.17.2 Description: A use-after-free issue exists due to improper data tracing. This can be triggered by calling the function nni mqtt msg get publish property in the file mqtt msg.c, potentially allowing an attacker to cause a...

leonards-property.co.uk Cross Site Scripting vulnerability OBB-3384969

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

MP4v2 安全漏洞

MP4v2 is a library for creating, modifying, and reading MP4 files by the individual developer enzo1982. A security vulnerability exists in MP4v2 version v2.1.3, which stems from the discovery of a contained memory leak via the MP4StringProperty class in mp4property.cpp...

CVE-2023-30601 Apache Cassandra: Privilege escalation when enabling FQL/Audit logs

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be...

UBUNTU-CVE-2023-33720

mp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty...

PT-2023-24456 · Mp4V2 · Mp4V2

Name of the Vulnerable Software and Affected Versions: mp4v2 version 2.1.2 Description: A memory leak was discovered in mp4v2 via the class MP4BytesProperty. Recommendations: For mp4v2 version 2.1.2, consider restricting access to the MP4BytesProperty class until a patch is available. At the...

WordPress plugin VikBooking Hotel Booking Engine & PMS 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2023-33294

An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctwebserver binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns...

CVE-2023-33294

An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctwebserver binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns...

brettproperty.co.uk Cross Site Scripting vulnerability OBB-3349455

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-V3FV-V9M6-26G3 Jenkins HashiCorp Vault Plugin has improper masking of credentials

Jenkins HashiCorp Vault Plugin 360.v0a1c04cf807d and earlier does not properly mask i.e., replace with asterisks credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met: - The credentials are printed in build steps executing on an...

xorg-x11-server: XIChangeProperty out-of-bounds access

A vulnerability was found in X.Org. The issue occurs because the handler for the XIChangeProperty request has a length-validation issue, resulting in out-of-bounds memory reads and potential information disclosure. This flaw can lead to local privilege elevation on systems where the X server runs...

xorg-x11-server: XIChangeProperty out-of-bounds access

A vulnerability was found in X.Org. The issue occurs because the handler for the XIChangeProperty request has a length-validation issue, resulting in out-of-bounds memory reads and potential information disclosure. This flaw can lead to local privilege elevation on systems where the X server runs...

PT-2023-3046 · Mp4V2 · Mp4V2

Name of the Vulnerable Software and Affected Versions: mp4v2 version 2.1.3 Description: The issue is related to a memory leak via the MP4StringProperty class in the mp4v2 library, which can be exploited by a remote attacker to cause a denial of service. The vulnerability is also associated with t...

CVE-2023-22706

Unauth. Reflected Cross-Site Scripting XSS vulnerability in PropertyHive plugin = 1.5.48 versions...

Cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Personnel Property Equipment System 1.0. Affected is an unknown function of the file admin/additem.php of the component POST Parameter Handler. The manipulation of the argument itemname leads to cross site scripting...