Moodle SQL Injection vulnerability

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database...

Mullvad VPN’s Office Raided By Police for User Data

By Waqas The raid took place at the Gothenburg office of Mullvad VPN on April 18th, 2023. This is a post from HackRead.com Read the original post: Mullvad VPNs Office Raided By Police for User Data...

CVE-2023-1196 Advanced Custom Fields - Contributor+ PHP Object Injection

The Advanced Custom Fields ACF Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present...

A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.

...

PT-2023-22683 · Unknown · Pear Admin Boot

Name of the Vulnerable Software and Affected Versions: Pear-Admin-Boot versions up to 2.0.2 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title of a private message. This enables attackers to...

PT-2023-14592 · WordPress · Softaculous Loginizer

Name of the Vulnerable Software and Affected Versions: Softaculous Loginizer plugin versions prior to 1.7.6 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowi...

Campcodes Coffee Shop POS System Cross-Site Scripting Vulnerability

Campcodes Coffee Shop POS System is a coffee shop POS system from Campcodes. A cross-site scripting vulnerability exists in Campcodes Coffee Shop POS System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the firstname parameter of the Users.php file,...

UBUNTU-CVE-2023-27954

The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4, watchOS 9.4. A website may be able to track sensitive user information...

AzuraCast Cross-Site Scripting Vulnerability

AzuraCast is a simple self-hosted webcast management suite from AzuraCast. A cross-site scripting vulnerability exists in AzuraCast version 0.18 and earlier, which stems from the lack of effective filtering and escaping of user-supplied data in the name field on the Edit Profile page, and can be...

Complaint Management System Cross-Site Scripting Vulnerability

Complaint Management System is a complaint management system. A cross-site scripting vulnerability exists in Complaint Management System v1.0, which originates in the parameter value of file admin/assets/plugins/DataTables/examples/examplessupport/editableajax.php. Lack of effective filtering and...

CVE-2023-2194

An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data-block0" variable was not limited to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dmabuffer. This issue could allow a local...

Mobicint 授权问题漏洞

Mobicint is Mobicint's mobile and desktop service for financial institutions. A security vulnerability exists in Mobicint version v3, which stems from the ability to retrieve partial e-mail addresses and user-entered information via the forgotten-password API...

Vulnerabilities fixed in Oracle Communications

Vulnerabilities have been fixed in Oracle Communications. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Bypassing authentication Remote code execution User rights Access to system data...

CVE-2023-28978

An Insecure Default Initialization of Resource vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to read certain confidential information. In the default configuration it is possible to read confidential information about locally configured...

DEBIAN-CVE-2023-2008

A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to...

CVE-2023-27890

The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

IBM TRIRIGA Application Platform 跨站脚本漏洞

The IBM TRIRIGA Application Platform is a set of technology platforms for deploying TRIRIGA applications from International Business Machines IBM. The platform provides a set of design-time and run-time components for building and running its enterprise-class applications, respectively, and...

Google Mandates Android Apps to Offer Easy Account Deletion In-App and Online

Google is enacting a new data deletion policy for Android apps that allow account creation to also offer users with a setting to delete their accounts in an attempt to provide more transparency and control over their data. "For apps that enable app account creation, developers will soon need to...

Cisco Secure Network Analytics 代码问题漏洞

Cisco Secure Network Analytics is one of the most comprehensive visibility and Network Traffic Analysis Nta/Network Detection and Response Ndr solutions from Cisco, Inc. It is used to provide continuous, real-time monitoring and a universal view of all network traffic. A security vulnerability...

Moby 安全漏洞

Moby is an open source project that aims to drive containerization of software and help the ecosystem mainstream container technology. A security vulnerability exists in Moby version 1.12 and later. Attackers have exploited the vulnerability to cause accidental disclosure of secrets or user data...