Sql injection

Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentially trick an administrator into performing an unsafe action via escape sequence injection, or might have a data size that causes a denial of service to a bastio...

Malicious code in ksm-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acbd11805012facf9e6ace839d7003088cf99552b9da073484d17920f72c5d9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8461 Malicious code in odn-static-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a49d8b382070675781a5628be927a75dfaa48ed927b0dbb4d39f49cde36bbc6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8450 Malicious code in airslate-static (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 187dae9cdc21ec49b7d2dd1609dcfe155123738e42a66793b16990e78bb18225 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8435 Malicious code in tvaultuiv2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5ffe7dc0907e6c0a6e1fc443558d8a6117e991d3b392e45eded0a16a22388fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross site scripting

The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'currentgroupid' parameter in version 6.0.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

The vulnerability of the `desktop_app/file.ajax.php?action=uploadfile` component in the main module of the Bitrix24 business management service allows a attacker to cause a service failure.

The vulnerability of the desktopapp/file.ajax.php?action=uploadfile component in the main module of the Bitrix24 business management service is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service...

[updated] Atlassian: “Take immediate action” to patch your Confluence Data Center and Server instances

Atlassian has released an advisory about a critical severity authentication vulnerability in the Confluence Server and Data Center. All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Atlassian Cloud sites are not impacted by this vulnerability, so if...

phpMyFAQ action parameter cross-site scripting vulnerability

phpMyFAQ is a multi-language, fully database-driven FAQ system. A cross-site scripting vulnerability exists in versions prior to phpMyFAQ 3.2.2, which stems from the lack of effective filtering and escaping of user-supplied data in the action parameter of admin/index.php?action=, and can be...

MAL-2023-8427 Malicious code in oathkeeper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea73ad8dc34b94ac335bdd186e92de178e5f301accb270da9e62f110c97920c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8418 Malicious code in demo-saas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7346c8d2670e05b376c36a799aafbe36cad56e319900ab63a766fea56e0985cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Patch now! BIG-IP Configuration utility is vulnerable for an authentication bypass

Tech company F5 has warned customers about a critical authentication bypass vulnerability impacting its BIG-IP product line that could result in unauthenticated remote code execution. F5 provides services focused on security, reliability, and performance. BIG-IP is a collection of hardware...

CVE-2023-21358

In UWB Google, there is a possible way for a malicious app to masquerade as system app com.android.uwb.resources due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21311

In Settings, there is a possible way to control private DNS settings from a secondary user due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21303

In Content, here is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-28316 · Douhaocms · Douhaocms

Name of the Vulnerable Software and Affected Versions: DouHaocms version 3.3 Description: A Cross Site Request Forgery CSRF issue allows a remote attacker to execute arbitrary code via the adminAction.class.php file. This can be exploited to perform unauthorized actions on the affected system...

PT-2023-18077 · Slice · Slice

Name of the Vulnerable Software and Affected Versions: Slice affected versions not specified Description: The issue in Slice involves a possible disclosure of installed applications due to side channel information disclosure, which could lead to local escalation of privilege without requiring...

Deeper Comments <= 2.1.1 - Subscriber+ Arbitrary Options Update

Description The plugin does not have authorisation in its updateoptions AJAX action, allowing any authenticated users, such as subscribers to update arbitrary blog options like defaultrole etc...

CVE-2022-34834

An issue was discovered in VERMEG AgileReporter 21.3. Attackers can gain privileges via an XSS payload in an Add Comment action to the Activity log...

CVE-2023-40123

In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...