Enhancing Security Operations Using Wazuh: Open Source XDR and SIEM

In today's interconnected world, evolving security solutions to meet growing demand is more critical than ever. Collaboration across multiple solutions for intelligence gathering and information sharing is indispensable. The idea of multiple-source intelligence gathering stems from the concept th...

CVE-2023-39508: Execution with Unnecessary Privileges

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the...

CVE-2023-3749 VideoEdge config

A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation...

CVE-2023-4067: Improper Neutralization of Input During Web Page Generation

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tabdate' and 'tabdater' parameters in versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for...

golang: html/template: improper handling of JavaScript whitespace

A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be...

Malicious code in yatai-web-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f548d205122fcfcec01de022463ec287546b7367481a1ec5adb29294e452b8f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-37976: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...

PT-2023-26223

Name of the Vulnerable Software and Affected Versions Radio Forge Muses Player with Skins plugin versions = 2.5 Description The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website...

python: urllib.parse url blocklisting bypass

A flaw was found in the Python package. An issue in the urllib.parse component could allow attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.This may lead to compromised Integrity...

MAL-2023-1192 Malicious code in grizzly_sql_graph_visualization (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 98b80123b8320ae78359836efd59f32caab21e7efffea59f91bfb61b947bbab9 The OpenSSF Package Analysis project identified 'grizzlysqlgraphvisualization' @ 0.2.3 npm as malicious. It is considered malicious because: - T...

CVE-2023-39261: Execution with Unnecessary Privileges

In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions...

CVE-2023-3947: Use of Hard-coded Cryptographic Key

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapiencryptdecrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meetin...

MAL-2023-1255 Malicious code in nwa-uikit-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 90a7d076b934f9928aa5301f8d62f0218fd96a1f59a26102659ee688114d764a The OpenSSF Package Analysis project identified 'nwa-uikit-web' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1295 Malicious code in shein-bbl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis eda3e2bdbc515dead593a808202f565c6b47090d1b73b40cda908b6786eaf4ac The OpenSSF Package Analysis project identified 'shein-bbl' @ 0.1.4-beta npm as malicious. It is considered malicious because: - The package...

CVE-2023-37289: Unrestricted Upload of File with Dangerous Type

It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in InfoDoc Document On-line Submission and Approval System, which allows an unauthenticated remote attacker can exploit this vulnerability without logging system to upload and run...

Vaidya-Mitra 1.0 - Multiple SQL injection Vulnerability

Title: Vaidya-Mitra 1.0 - Multiple SQLi Author: nu11secur1ty Vendor: https://mayurik.com/ Software: free: https://www.sourcecodester.com/php/16720/free-hospital-management-system-small-practices.html, https://mayurik.com/source-code/P5890/best-hospital-management-system-in-php Reference:...

WordPress BuddyForms Attach Post with Group Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software BuddyForms Attach Post with Group Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 9d4312fdd8bd Credits Rafie Muhammad...

WordPress Pay With Stripe Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Pay With Stripe Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID be89fddecdf5 Credits Rafie Muhammad Patchstack Required...

MAL-2023-1103 Malicious code in @region-lib/helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0f84da1cfecc0e380a493053daa5d6240c342559aefe6ff74ccb3ef6e66ac7d0 The OpenSSF Package Analysis project identified '@region-lib/helper' @ 2000.0.1 npm as malicious. It is considered malicious because: - The...

PT-2025-40683

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to out-of-bounds access during out-of-band oob write operations in rawnand brcmnand. Specifically, when the oob buffer length is not a multiple ...