Exploit for Improper Authentication in Fit2Cloud Jumpserver

Process of exploiting the JumpServer unauthorized acce...

Where to find Opera’s Privacy and Security team online

Security Where to find Opera’s Privacy and Security team online Share September 27th, 2023 Hello everyone! Through this blog, we strive to offer timely updates and important information about Opera and our products. This helps us maintain an open line of communication with our users, particularly...

CVE-2023-42820

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local...

Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2023-013 (ALASFIREFOX-2023-013)

The version of firefox installed on the remote host is prior to 102.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-013 advisory. Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian...

CVE-2023-32364

creationtimestamp| type| source ---|---|--- 2023-09-26 14:54:54+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5222 2026-09-02 01:00:18+00:00| seen| Telegram/X3aV2Rz-O19d62DmeY189IyrU-cEp-mvJffxLnOe55jNbE 2026-09-03 00:00:37+00:00| published-proof-of-concept|...

Chinese Hackers TAG-74 Targets South Korean Organizations in a Multi-Year Campaign

A "multi-year" Chinese state-sponsored cyber espionage campaign has been observed targeting South Korean academic, political, and government organizations. Recorded Future's Insikt Group, which is tracking the activity under the moniker TAG-74, said the adversary has been linked to "Chinese...

CVE-2023-41867

Unauth. Reflected Cross-Site Scripting XSS vulnerability in AcyMailing Newsletter Team AcyMailing plugin = 8.6.2 versions...

CVE-2023-41867

CVE-2023-41867 affects the AcyMailing SMTP Newsletter WordPress plugin (AcyMailing) up to version 8.6.2. It is an unauthenticated, Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization in how output is generated, enabling attacker-supplied code to be reflect...

CVE-2023-41871

CVE-2023-41871 is an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the Poll Maker Team Poll Maker WordPress plugin, affecting versions

CVE-2023-41867: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in AcyMailing Newsletter Team AcyMailing plugin = 8.6.2 versions...

CVE-2023-41871: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Poll Maker Team Poll Maker plugin = 4.7.0 versions...

PT-2023-28129

Name of the Vulnerable Software and Affected Versions AcyMailing Newsletter Team AcyMailing plugin versions = 8.6.2 Description The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website, potentially allowing...

HTMLSmuggler - HTML Smuggling Generator And Obfuscator For Your Red Team Operations

The full explanation what is HTML Smuggling may be found here. The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion detection systems, by disguising malicious payloads within seemingly harmless HTML and JavaScript code. By exploiting the...

CVE-2023-3892

Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup. In order to take advantage of this vulnerability, an attacker must craft a malicious XML document, embed this docume...

Xxe

Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup. In order to take advantage of this vulnerability, an attacker must craft a malicious XML document, embed this docume...

Malicious code in team-atf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc4bc178a5c3fa44d9ed6dfa7c429692ad3bb5b15556ee5cfcf089935bc92d54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in team-atf-3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3dbd02e3dfb7a6582ce683aed8cb3cf5be7a1a449fe0ac5ce208d87034938dbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8182 Malicious code in team-atf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc4bc178a5c3fa44d9ed6dfa7c429692ad3bb5b15556ee5cfcf089935bc92d54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in team-atf-3

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in team-atf

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...