CVE-2023-41871: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Poll Maker Team Poll Maker plugin = 4.7.0 versions...

HTMLSmuggler - HTML Smuggling Generator And Obfuscator For Your Red Team Operations

The full explanation what is HTML Smuggling may be found here. The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion detection systems, by disguising malicious payloads within seemingly harmless HTML and JavaScript code. By exploiting the...

CVE-2023-3892

Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup. In order to take advantage of this vulnerability, an attacker must craft a malicious XML document, embed this docume...

Xxe

Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup. In order to take advantage of this vulnerability, an attacker must craft a malicious XML document, embed this docume...

Malicious code in team-atf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc4bc178a5c3fa44d9ed6dfa7c429692ad3bb5b15556ee5cfcf089935bc92d54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in team-atf-3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3dbd02e3dfb7a6582ce683aed8cb3cf5be7a1a449fe0ac5ce208d87034938dbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8182 Malicious code in team-atf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc4bc178a5c3fa44d9ed6dfa7c429692ad3bb5b15556ee5cfcf089935bc92d54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in team-atf

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in team-atf-3

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in simple-team-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad5da4b4631227adabb1a524dc451f3f7fce259d5c7c64d148e91f6edc74d4a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in simple-team-api

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-8180 Malicious code in simple-team-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad5da4b4631227adabb1a524dc451f3f7fce259d5c7c64d148e91f6edc74d4a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-8733

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a null pointer dereference error in the Linux kernel's team component when the team device type is changed from non-ether to ether. This occurs because the header...

Security Updates for Microsoft Team Foundation Server and Azure DevOps Server (September 2023)

The Microsoft Team Foundation Server or Azure DevOps install is missing security updates. It is, therefore, affected by multiple server remote code execution vulnerabilities. An authenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Note that Ness...

SUSE CVE-2023-4881

CVE-2023-4881 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security team...

K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack

Impact An issue was found in K3s where an attacker with network access to K3s servers' apiserver/supervisor port TCP 6443 can force the TLS server to add entries to the certificate's Subject Alternative Name SAN list, through a stuffing attack, until the certificate grows so large that it exceeds...

Argo CD repo-server Denial of Service vulnerability

Impact All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious,...

team-match.com Cross Site Scripting vulnerability OBB-3660749

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

EmploLeaks - Finding Leaked Employees Info for the Win

Developed by Faraday security researchers, this cutting-edge tool utilizes the power of OpenSource Intelligence techniques. EmploLeaks extracts valuable insights by scouring various platforms, to compile a comprehensive list of employees associated with a given company and cross-reference these...

Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities

Exploit Title: Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities Google Dork: N/A Date: 25/08/2023 Exploit Author: The Security Team exploitsecurity.io Vendor Homepage: https://www.jaycar.com.au/wireless-gateway-home-automation-controller/p/LA5570 Software...