Citrix Secure Access < 23.5.1.3 Privilege Escalation (CTX561480)

A privilege escalation vulnerability has been discovered in the Citrix Secure Access client for Windows which, if exploited, could allow an attacker with access to an endpoint with Standard User Account that has the vulnerable client installed to escalate their local privileges to that of NT...

CVE-2023-38195

Datalust Seq before 2023.2.9489 allows insertion of sensitive information into an externally accessible file or directory. This is exploitable only when external SQL Server or PostgreSQL metadata storage is used. Exploitation can only occur from a high-privileged user account...

GHSA-9436-3GMP-4F53 grav Server-side Template Injection (SSTI) mitigation bypass

Summary The fix for SSTI using |map, |filter and |reduce twigs implemented in the commit 71bbed1 introduces bypass of the denylist due to incorrect return value from isDangerousFunction, which allows to execute the payload prepending double backslash \ Details The isDangerousFunction check in...

Huawei EulerOS: Security Advisory for shadow (EulerOS-SA-2023-2368)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-37268 User login confusion with SSO in warpgate

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been...

Bazaar Social Listing Shopping Web PHP Template 2.3.2 Cross Site Scripting

==================================================================================================================================== | Title : Bazaar Social Listing Shopping Web PHP Template v2.3.2 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser :...

WEM Policy For Users Account to Restrict the CPU & Memory Usage

WEM Policy For Users Account to Restrict the CPU & Memory Usage. We need to some percentage CPU & Memory only to use the CPU & Memory where users are accessing the chrome browsers , etc applications in citrix...

Bazaar Social Listing Shopping Web PHP Template 2.3.2 Privilege Escalation

==================================================================================================================================== | Title : Bazaar | Social Listing Shopping Web PHP Template v2.3.2 Privilege Escalation Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.P...

CVE-2023-24491

A vulnerability has been discovered in the Citrix Secure Access client for Windows which, if exploited, could allow an attacker with access to an endpoint with Standard User Account that has the vulnerable client installed to escalate their local privileges to that of NT AUTHORITY\SYSTEM...

CVE-2023-3076

CVE-2023-3076 affects the MStore API WordPress plugin (pre-3.9.9). The wholesale REST API endpoint allows unauthenticated visitors to create user accounts with a role of their choice, enabling privilege escalation, and this attack is conditioned on the site owner purchasing pro features. The NVD/...

OPENSUSE-SU-2023:0171-1 Security update for nextcloud-desktop

This update for nextcloud-desktop fixes the following issues: Update ot 3.8.0 - Resize WebView widget once the loginpage rendered - Feature/secure file drop - Check German translation for wrong wording - L10n: Correct word - Fix displaying of file details button for local syncfileitem activities ...

CVE-2023-36256

The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent. The email of the user to be deleted is...

Cross site request forgery (csrf)

The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent. The email of the user to be deleted is...

CVE-2023-36256

The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent. The email of the user to be deleted is...

CVE-2023-36256

The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent. The email of the user to be deleted is...

Project Worlds Online Examination System 跨站请求伪造漏洞

Project Worlds Online Examination System is an online examination system Project Worlds Online Examination System version 1.0 suffers from a cross-site request forgery vulnerability that originates from an attacker being able to craft a malicious link that, when clicked by an administrator user,...

Advisory ROSA-SA-2023-2181

Software: Grafana 6.7.4 OS: ROSA Virtualization 2.1 packageevrstring: grafana-6.7.4-3.rv3.src.rpm CVE-ID: CVE-2023-3128 BDU-ID: 2023-03343 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the Grafana web-based data submission tool is related to authentication bypass via spoofing. Exploitation of...

CVE-2023-3460

CVE-2023-3460 affects the WordPress plugin Ultimate Member prior to version 2.6.7. The vulnerability allows unauthenticated attackers to create user accounts with arbitrary capabilities, effectively enabling privilege escalation to Administrator via manipulation of wp_capabilities during registra...

CVE-2023-35801

A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a network-based resource connection, resulting in the unauthorized reading and writing of arbitrary files. Successful exploitation requires an attacker to have acce...

MULTI#STORM Campaign Targets India and U.S. with Remote Access Trojans

A new phishing campaign codenamed MULTISTORM has set its sights on India and the U.S. by leveraging JavaScript files to deliver remote access trojans on compromised systems. "The attack chain ends with the victim machine infected with multiple unique RAT remote access trojan malware instances, su...