Moxa NPort Plain Text Storage of Passwords (CVE-2016-9348)

An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPor...

Moxa EDR-810 Plaintext Password Storage (CVE-2017-12127)

A password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317. An attacker with shell access could extract passwords in clear text from the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot...

Hacking AI Resume Screening with Text in a White Font

The Washington Post is reporting on a hack to fool automatic resume sorting programs: putting text in a white font. The idea is that the programs rely primarily on simple pattern matching, and the trick is to copy a list of relevant keywords--or the published job description--into the resume in a...

The vulnerability of the CrashAlwaysIf function in the PDF, EPUB, MOBI, FB2, CHM, XPS, and DjVu formats allows a perpetrator to trigger a service failure.

The vulnerability of the CrashAlwaysIf function in the PDF, EPUB, MOBI, FB2, CHM, XPS, and DjVu formats processing documents by SumatraPDF is related to the copying of buffers without checking the size of the input data when processing text files first.txt and second.txt. Exploiting this...

CVE-2023-0602

The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen...

CVE-2023-0602

The CVE-2023-0602 entry concerns the WordPress plugin Twittee Text Tweet (versions

CVE-2023-0602 Twittee Text Tweet <= 1.0.8 - Reflected XSS

The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen...

Malicious code in @ikea-aoa/component-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a7eb8663a77a76b087087ae0d7313f1e7e50f71695a76b02e73d72e08467c8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1024 Malicious code in @ikea-aoa/component-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a7eb8663a77a76b087087ae0d7313f1e7e50f71695a76b02e73d72e08467c8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-6376 · WordPress · Twittee Text Tweet Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Twittee Text Tweet WordPress plugin versions 1.0.0 through 1.0.8 Description: The issue arises from the plugin's failure to properly escape POST values, which are then printed back to the user inside one of the plugin's administrative pages...

Slackware Linux 15.0 / current mozilla-thunderbird Vulnerability (SSA:2023-212-01)

The version of mozilla-thunderbird installed on the remote host is prior to 102.13.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-212-01 advisory. - Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be...

GHSA-8FV7-WQ38-F5C9 Cross-site scripting (XSS) from MIME type auto-detection of uploaded files

TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to upload an arbitrary file to the content folder. Your Kirby sites are not affected if they don't allow file uploads for untrusted users ...

WordPress Enhanced Text Widget Plugin <= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Enhanced Text Widget Type Plugin Vulnerable versions = 1.5.7 Fixed in 1.5.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3977 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 005d3b171c4a Credits WordFence...

WordPress Enhanced Text Widget Plugin <= 1.5.7 is vulnerable to Broken Access Control

Software Enhanced Text Widget Type Plugin Vulnerable versions = 1.5.7 Fixed in 1.5.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0958 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2f1a0df14a11 Credits WordFence Required...

PT-2023-27126 · Unknown · Phpscriptpoint Recipepoint

Name of the Vulnerable Software and Affected Versions: phpscriptpoint RecipePoint version 1.9 Description: A critical issue was found in phpscriptpoint RecipePoint, affecting an unknown part of the file /recipe-result. The manipulation of the argument text/category/type/difficulty/cuisine/cooking...

phpscriptpoint RecipePoint SQL注入漏洞

RecipePoint is a SaaS multi-vendor recipe platform from the phpscriptpoint team. A SQL injection vulnerability exists in phpscriptpoint RecipePoint version 1.9, which stems from the parameter text/category/type/difficulty/cuisine/cookingmethod in the file /recipe-result that can lead to sql...

Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping

Exploit Title: Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping Google Dork: NA Date: 22-07-2023 Exploit Author: H4rk3nz0 Vendor Homepage: https://www.keepersecurity.com/enGB/ Software Link: https://www.keepersecurity.com/enGB/get-keeper.html Version: Desktop App...

July 27, 2023, update for Office 2016 (KB5002307)

None None...

PT-2023-6563

Name of the Vulnerable Software and Affected Versions net/html library affected versions not specified Description The issue arises from text nodes not in the HTML namespace being incorrectly literally rendered, causing text that should be escaped to not be. This could lead to an XSS attack. The...

SUSE CVE-2023-3417

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...