7249 matches found
VulnCheck KEV: CVE-2020-3259
Cisco Adaptive Security Appliance ASA and Firepower Threat Defense FTD contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the...
User Activity Tracking and Log < 4.1.4 - IP Spoofing
Description This plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. 1. Add X-Forwarded-For: 11.11.11.11 to any request which will be in activity log. For example in creation of new post. 2. View the activity log and see that the...
User Activity Tracking and Log < 4.1.4 - IP Spoofing
Description This plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. PoC 1. Add X-Forwarded-For: 11.11.11.11 to any request which will be in activity log. For example in creation of new post. 2. View the activity log and see that...
Guidance: Assembling a Group of Products for SBOM
Today, CISA published Guidance on Assembling a Group of Products created by the Software Bill of Materials SBOM Tooling & Implementation Working Group, one of the five SBOM community-driven workstreams facilitated by CISA. CISA’s community-driven working groups publish documents and reports to...
Cross site scripting
An out-of-bounds read vulnerability was found in Netfilter Connection Tracking conntrack in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol...
CVE-2023-39197
The CVE-2023-39197 entry concerns an out-of-bounds read in Linux kernel Netfilter Connection Tracking (conntrack) for DCCP. A remote attacker could disclose kernel memory contents via crafted DCCP traffic due to copying an unbounded portion of the conntrack header; the issue is categorized as a k...
CVE-2023-39197 Kernel: dccp: conntrack out-of-bounds read in nf_conntrack_dccp_packet()
An out-of-bounds read vulnerability was found in Netfilter Connection Tracking conntrack in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol...
CVE-2023-39197 Kernel: dccp: conntrack out-of-bounds read in nf_conntrack_dccp_packet()
An out-of-bounds read vulnerability was found in Netfilter Connection Tracking conntrack in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol...
Important: webkitgtk4
Issue Overview: Impact: Visiting a website that frames malicious content may lead to UI spoofing. Description: The issue was addressed with improved UI handling. CVE-2022-32919 A website may be able to track the websites a user visited in Safari private browsing mode. CVE-2022-32933 A spoofing...
Google Incognito Mode: New Disclaimer Reveals Data Tracking
By Deeba Ahmed Is Google Incognito mode really private? Well, the answer is no. Why? Let's take a closer look... This is a post from HackRead.com Read the original post: Google Incognito Mode: New Disclaimer Reveals Data Tracking...
Case Study: The Cookie Privacy Monster in Big Global Retail
Explore how an advanced exposure management solution saved a major retail industry client from ending up on the naughty step due to a misconfiguration in its cookie management policy. This wasn't anything malicious, but with modern web environments being so complex, mistakes can happen, and...
CVE-2023-50729
Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent because Traccar is recommended to run web servers as root...
Unrestricted file upload
Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent because Traccar is recommended to run web servers as root...
CVE-2023-50729
CVE-2023-50729 affects Traccar before version 5.11, due to an unrestricted file upload vulnerability in the File feature. The issue allows an attacker to execute arbitrary code on the server and is particularly risky because Traccar can operate with root privileges and can write to arbitrary loca...
CVE-2023-50919
creationtimestamp| type| source ---|---|--- 2024-01-12 09:26:42+00:00| seen| https://t.me/ctinow/167149 2024-01-19 08:17:07+00:00| seen| https://t.me/ctinow/170095 2024-01-23 20:16:11+00:00| seen|...
WooCommerce Conversion Tracking < 2.0.12 - Subscriber+ happy-elementor-addons Installation & Activation
Description The plugin does not have authorisation checks in some AJAX actions, which could allow any authenticated users, such as subscriber to install and activate the happy-elementor-addons addon plugin...
Threat Actors Increasingly Abusing GitHub for Malicious Purposes
The ubiquity of GitHub in information technology IT environments has made it a lucrative choice for threat actors to host and deliver malicious payloads and act as dead drop resolvers, command-and-control, and data exfiltration points. "Using GitHub services for malicious infrastructure allows...
Atomic Stealer rings in the new year with updated version
Last year, we documented malware distribution campaigns both via malvertising and compromised sites delivering Atomic Stealer AMOS onto Mac users. This stealer has proven to be quite popular in the criminal underground and its developers have been adding new features to justify its hefty...
DEBIAN-CVE-2021-3600
It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code...
Out-of-bounds
It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code...