3921 matches found
SUSE-RU-2023:2566-1 Security update for SUSE Manager Server 4.3
This update fixes the following issues: branch-network-formula: - Update to version 0.1.1680167239.23f2fec Remove unnecessary import of 'salt.ext.six' cobbler: - Fix cobbler buildiso so that the artifact can be booted by EFI firmware. bsc1206060 - Switch packaging from patch based to Git tree bas...
Online School Fees System SQL注入漏洞
Online School Fees System is an online tuition system. A SQL injection vulnerability exists in Online School Fees System v1.0, which originates from a lack of validation of the parameter namestartsWith for externally entered SQL statements in the file ajx.php in the component GET Parameter Handle...
MAL-2023-1172 Malicious code in ent-memberassistance-helppopup (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 617211f3573ab14bc57da3efe5ce49c8ed667e590c643d1a62fbe680ab531b48 The OpenSSF Package Analysis project identified 'ent-memberassistance-helppopup' @ 1.0.0 npm as malicious. It is considered malicious because: -...
Malicious code in gitlabhook (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07cc248a040f88d3052194678254b7bc9be0a2f3f9dda89ed16981c2c86510ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2023-33243
RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become be...
CVE-2023-23818: Improper Neutralization of Input During Web Page Generation
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Aviplugins.Com WP Register Profile With Shortcode plugin = 3.5.7 versions...
GHSA-XP5H-F8JF-RC8Q rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements
NOTE: rails-ujs is part of Rails/actionview since 5.1.0. There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML...
CVE-2023-2604: Improper Neutralization of Input During Web Page Generation
The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘searchterm’ parameter in versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...
PT-2023-7362 · Docker · Play With Docker
Name of the Vulnerable Software and Affected Versions: Play With Docker versions prior to 0.0.2 Description: The issue is related to an insecure CAP SYS ADMIN privileged mode in Play With Docker, which is associated with inadequate access control. This can be exploited by a remote attacker to...
CVE-2022-4569: Incorrect Default Permissions
A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with local access to execute code with elevated privileges during the package upgrade or installation...
CVE-2023-2406
The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 1.3.1 due to insufficien...
CVE-2023-2406: Improper Neutralization of Input During Web Page Generation
The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 1.3.1 due to insufficien...
CVE-2023-2407: Cross-Site Request Forgery (CSRF)
The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing nonce validation in the lsparsevcitacallback function. This...
Improved BlackCat Ransomware Strikes with Lightning Speed and Stealthy Tactics
The threat actors behind BlackCat ransomware have come up with an improved variant that prioritizes speed and stealth in an attempt to bypass security guardrails and achieve their goals. The new version, dubbed Sphynx and announced in February 2023, packs a "number of updated capabilities that...
MAL-2023-1085 Malicious code in @mddsfmsdflm/itemselector (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 88f4e295b9c4b793c8ffbdc4077606b6d5b61c41ab83b85bda2b46680c678174 The OpenSSF Package Analysis project identified '@mddsfmsdflm/itemselector' @ 103.0.9 npm as malicious. It is considered malicious because: - Th...
Malicious code in itemsselector (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 607e39766ebd77980775c45bf29b7b5ce6a18704c30bd4e722cde47b95d53b0b The OpenSSF Package Analysis project identified 'itemsselector' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Made with Fuel Better Notifications for WP plugin = 1.9.2 versions...
CVE-2023-32964
Cross-Site Request Forgery CSRF vulnerability in Made with Fuel Better Notifications for WP plugin = 1.9.2 versions...
